| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: System Message - Write Fault Error / system error hard disk failure detectedWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
13.09.2012, 00:16
| #1 |
 |  System Message - Write Fault Error / system error hard disk failure detected Hallo, ich habe das gleiche Problem wie hier auch schon oft geschieldert wurde! Hab keinen Zugrief mehr auf meine Programme, Partitionen. Auf meinem Desktop ist nur noch die Papierkorb und Firefox Verknüpfung. Sofort nach dem hochfahren des Rechners kommt die Fehlermeldung: "System Message - Write Fault Error" Diese Meldung kommt sofort 20 - 30 mal! Wenn ich etwas öffnen möchte kommt: "system error hard disk failure detected" Hab jetzt schon den Anti-Malware und OTL Scan durchgeführt. Jetzt weiß ich aber nicht wie es weiter geht und bitte dringend um Hilfe!!!!! Schön mal vielen Dank im vorraus!!!!!!! Malwarebytes Anti-Malware (Test) 1.65.0.1400 www.malwarebytes.org Datenbank Version: v2012.09.07.13 Windows 7 x64 FAT32 Internet Explorer 9.0.8112.16421 Diseck :: DISECK-PC [Administrator] Schutz: Aktiviert 12.09.2012 23:32:35 mbam-log-2012-09-13 (02-02-24).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 437251 Laufzeit: 50 Minute(n), 11 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 5 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|nbxlbdib (Trojan.Phex.THAGen6) -> Daten: "C:\Users\Diseck\AppData\Local\hpidhalm.exe" -> Keine Aktion durchgeführt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|jipudqbw (Trojan.Phex.THAGen6) -> Daten: "C:\Users\Diseck\AppData\Local\hpidhalm.exe" -> Keine Aktion durchgeführt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|xawnaakp (Trojan.Phex.THAGen6) -> Daten: "C:\Users\Diseck\AppData\Local\awphddcn.exe" -> Keine Aktion durchgeführt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableRegedit (Hijack.Regedit) -> Daten: 0 -> Keine Aktion durchgeführt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableRegedit (Hijack.Regedit) -> Daten: 0 -> Keine Aktion durchgeführt. Infizierte Dateiobjekte der Registrierung: 2 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Keine Aktion durchgeführt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowSearch (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Keine Aktion durchgeführt. Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 8 C:\Users\Diseck\AppData\Local\hpidhalm.exe (Trojan.Phex.THAGen6) -> Keine Aktion durchgeführt. C:\Users\Diseck\AppData\Local\awphddcn.exe (Trojan.Phex.THAGen6) -> Keine Aktion durchgeführt. C:\Users\Diseck\AppData\Local\tdsrexct.exe (Trojan.LameShield) -> Keine Aktion durchgeführt. C:\Users\Diseck\Downloads\etypesetup.exe (PUP.BundleInstaller.BI) -> Keine Aktion durchgeführt. C:\Users\Diseck\Downloads\Hama_Gamepad_FIFA08_Patch_98SE_ME_2k_XP_VISTA_V2.exe (Adware.Onlinegames) -> Keine Aktion durchgeführt. C:\Users\Diseck\Downloads\PDFCreatorSetup.exe (Adware.Agent) -> Keine Aktion durchgeführt. C:\Users\Diseck\Downloads\VideoPlayerSetup.exe (Adware.Agent) -> Keine Aktion durchgeführt. C:\Users\Diseck\Downloads\video_downloader.exe (PUP.BundleInstaller.VG) -> Keine Aktion durchgeführt. (Ende) OTL Extras logfile created on: 13.09.2012 01:14:10 - Run 1 OTL by OldTimer - Version 3.2.61.3 Folder = H:\ 64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 2,17 Gb Available Physical Memory | 54,24% Memory free 7,99 Gb Paging File | 5,38 Gb Available in Paging File | 67,29% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 97,66 Gb Total Space | 6,40 Gb Free Space | 6,55% Space Free | Partition Type: NTFS Drive D: | 488,18 Gb Total Space | 199,85 Gb Free Space | 40,94% Space Free | Partition Type: NTFS Drive E: | 345,57 Gb Total Space | 183,08 Gb Free Space | 52,98% Space Free | Partition Type: NTFS Drive F: | 5,75 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF Drive H: | 7,44 Gb Total Space | 7,43 Gb Free Space | 99,86% Space Free | Partition Type: FAT32 Computer Name: DISECK-PC | User Name: Diseck | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation) [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [edit] -- Reg Error: Key error. htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation) InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" () Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" () Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [edit] -- Reg Error: Key error. htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" () Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" () Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 ========== Authorized Applications List ========== ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{16F0E76E-731E-4291-A35B-D0A8038B184F}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | "{F9421D14-FA59-4259-BC69-48CC612BDDE6}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{006FF7C4-FDBB-4F57-A340-9D3455FB6492}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe | "{14C91D2C-4DAB-4089-B9DA-49E67C202DCF}" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\battlefield bad company 2\bfbc2updater.exe | "{170ED376-A6C0-4E09-B3FB-B4CBB162FB9E}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | "{1937D28F-E0D6-419E-9230-A94EC7044A61}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{1B808C0D-598B-419B-9A02-0DFE2D7A2E94}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | "{1E0E7F2B-BCEA-472C-AE47-8CE3906404B1}" = protocol=17 | dir=in | app=c:\windows\system32\hasplms.exe | "{1EFD6468-8B96-4696-9C32-F3C672819EE9}" = protocol=6 | dir=in | app=c:\windows\system32\hasplms.exe | "{21E43461-CD03-4C3A-A3BE-70DC3AD0F1ED}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{36218059-6F7A-46AC-ABE6-B2C59A39634E}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | "{395688C8-B196-4CFC-B9B9-905B86B74757}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | "{75045F65-F7EA-4C73-8C94-1FB5B7F20F30}" = protocol=17 | dir=in | app=c:\program files (x86)\origin games\battlefield 3\bf3.exe | "{792073B7-FA0E-42B8-AFF1-E904FE265F70}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | "{79C18F39-1FE1-4D26-90B1-D30CC24011C0}" = protocol=17 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe | "{8A1F7D6F-5BDF-431A-AA18-D75CF596351E}" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\battlefield bad company 2\bfbc2updater.exe | "{8AE41A00-8308-4C1C-8B6D-C024283BC0CD}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | "{9746E809-B288-4A1C-8D3F-CE071A44E708}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | "{BACBAA81-1214-4B5B-8205-BCA1F159D478}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | "{C2520D6B-E197-4E9B-A592-47E64E157914}" = protocol=6 | dir=in | app=c:\program files (x86)\origin games\battlefield 3\bf3.exe | "{C376B257-32D7-4C67-94D6-DF01FEDFB7C5}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | "{C948949B-CB17-45DF-BD12-F1933863327B}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | "{FC2A67A8-C97E-4E89-AA1A-545E904FD161}" = protocol=6 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe | "TCP Query User{46417B25-B4DC-4B0F-8459-C4D85CA73226}C:\program files (x86)\electronic arts\battlefield bad company 2\bfbc2game.exe" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\battlefield bad company 2\bfbc2game.exe | "TCP Query User{BE4004B0-B63D-4438-A40B-361F0CDF9825}C:\program files (x86)\epson software\event manager\eeventmanager.exe" = protocol=6 | dir=in | app=c:\program files (x86)\epson software\event manager\eeventmanager.exe | "UDP Query User{1DAA7ED0-12F3-4148-BA62-AE681AEBF1F4}C:\program files (x86)\electronic arts\battlefield bad company 2\bfbc2game.exe" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\battlefield bad company 2\bfbc2game.exe | "UDP Query User{598F882C-B32B-4D9D-8938-6F8CD5D5806B}C:\program files (x86)\epson software\event manager\eeventmanager.exe" = protocol=17 | dir=in | app=c:\program files (x86)\epson software\event manager\eeventmanager.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector "{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant "{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 "{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 "{4BDE7544-0A08-4AD9-8A8F-4B7944471C36}" = iTunes "{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 "{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour "{8B485965-8EFE-464A-842F-CF8F18C3DFD7}" = iCloud "{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 296.10 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 296.10 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 296.10 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 296.10 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0213 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.7.11 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.3.12.0 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components "{B8AD779A-82DA-4365-A7D0-AD3DCFC55CFF}" = Apple Mobile Device Support "{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile "EPSON SX210 Series" = EPSON SX210 Series Printer Uninstall "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "WinRAR archiver" = WinRAR 4.01 (64-Bit) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{08C8666B-C502-4AB3-B4CB-D74AC42D14FE}" = Nero BackItUp 10 Help (CHM) "{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer "{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1 "{16987E99-C95C-4513-9239-7B44A0A71DB5}" = Nero SoundTrax 10 Help (CHM) "{1ADE1AA0-7F82-4BB1-B1BD-727DE438057B}" = Cool & Quiet "{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{1F7FB68F-52F6-46A3-B42F-38CE46295AE5}" = Nero MediaHub 10 "{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions "{22B0E143-2B0B-435B-9F56-136A3D16065F}" = No23 Recorder "{237CCB62-8454-43E3-B158-3ACD0134852E}" = High-Definition Video Playback 10 "{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F}" = Nero Core Components 10 "{26A24AE4-039D-4CA4-87B4-2F83217005FF}" = Java(TM) 7 Update 5 "{277C1559-4CF7-44FF-8D07-98AA9C13AABD}" = Nero Multimedia Suite 10 "{310BC5E2-31AF-49BB-904D-E71EB93645DC}" = AI Suite "{329411A0-19F3-4740-874F-17400B126F27}" = Nero Vision 10 Help (CHM) "{33643918-7957-4839-92C7-EA96CB621A98}" = Nero Express 10 Help (CHM) "{34490F4E-48D0-492E-8249-B48BECF0537C}" = Nero DiscSpeed 10 "{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack "{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}" = JMicron JMB36X Driver "{3AC8457C-0385-4BEA-A959-E095F05D6D67}" = Battlefield: Bad Company™ 2 "{48F22622-1CC2-4A83-9C1E-644DD96F832D}" = Epson Event Manager "{491D92A9-69CA-4EB4-81D3-0106F9337957}" = TurboV EVO "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{523B2B1B-D8DB-4B41-90FF-C4D799E2758A}" = Nero ControlCenter 10 Help (CHM) "{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver "{555868C6-49FB-484F-BB43-8980651A1B00}" = Nero BurnRights 10 Help (CHM) "{56DD3770-2EF5-42D0-BA5A-A8135E9D4A9E}" = USB Dual Vibration PAD "{62C6F05A-5E4B-40C6-AD5A-B773A1A5624B}" = Fan Xpert "{63AA3EAB-23BB-48B2-9AD0-44F878075604}" = Nero 10 Menu TemplatePack Basic "{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update "{66049135-9659-4AAD-9169-9CCA269EBB3E}" = Nero InfoTool 10 Help (CHM) "{66D6F3BD-CA23-41A4-9FA3-96B26B32528D}" = Command & Conquer Die ersten 10 Jahre "{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE "{68AB6930-5BFF-4FF6-923B-516A91984FE6}" = Nero BackItUp 10 "{6DFB899F-17A2-48F0-A533-ED8D6866CF38}" = Nero Control Center 10 "{70550193-1C22-445C-8FA4-564E155DB1A7}" = Nero Express 10 "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{74F28F11-404B-4CEA-92FF-37BF476F239E}" = VirtualDJ PRO Full "{76285C16-411A-488A-BCE3-C83CB933D8CF}" = Battlefield 3™ "{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update "{7A295D8F-484B-4FFB-89AB-C1FD497591FE}" = Nero WaveEditor 10 Help (CHM) "{7A5D731D-B4B3-490E-B339-75685712BAAB}" = Nero Burning ROM 10 "{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime "{82EF29B1-9B60-4142-A155-0599216DD053}" = LightScribe System Software "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform "{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar "{87C2248A-C7DD-49ED-9BCD-B312A9D0819E}" = Epson Easy Photo Print 2 "{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver For Windows 7 "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT "{8ECEC853-5C3D-4B10-B5C7-FF11FF724807}" = Nero Recode 10 "{92E25238-61A3-4ACD-A407-3C480EEF47A7}" = Nero RescueAgent 10 Help (CHM) "{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195 "{943CFD7D-5336-47AF-9418-E02473A5A517}" = Nero BurnRights 10 "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9A4297F3-2A51-4ED9-92CA-4BCB8380947E}" = Nero Vision 10 "{9B6B24BE-80E7-46C4-9FA5-B167D5E0F345}" = Nero BurningROM 10 Help (CHM) "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 "{9C2AC00C-0C06-4B7E-97A4-A833808D54D6}" = EPU "{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR "{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common "{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.1) - Deutsch "{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint "{B6A98E5F-D6A7-46FB-9E9D-1F7BF4434001}" = Epson Printer Software Downloader "{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call "{B8887E02-C910-4498-A7C0-186ABFDCD110}" = GPU Boost Driver "{B8ABD8C7-991E-4A70-B5A3-20C6FC680680}" = LogMeIn Hamachi "{C18A0418-442A-4186-AF98-D08F5054A2FC}" = Nero DiscSpeed 10 Help (CHM) "{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common "{C3273C55-E1E4-41FF-8D69-0158090DB8D8}" = Nero CoverDesigner 10 Help (CHM) "{C3580AC4-C827-4332-B935-9A282ED5BB97}" = Nero Dolby Files 10 "{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform "{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}" = Microsoft Primary Interoperability Assemblies 2005 "{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform "{D793423B-FF18-4A54-B9C9-75B3396BAAC4}" = Browser Configuration Utility "{DA909E62-3B45-4BA1-8B58-FCAEBA4BCEC9}" = NVIDIA PhysX "{DB7C1D4A-08BA-4C7E-A8AA-B7F9BB372DCF}" = Nero Recode 10 Help (CHM) "{DDE59617-F59A-473B-BC4E-C2B81F6CD38D}" = Command & Conquer™ Red Alert™ 3 Uprising "{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10 "{E1EE5339-5D32-458F-BAAB-B19F6301BCE2}" = Nero SoundTrax 10 "{E337E787-CF61-4B7B-B84F-509202A54023}" = Nero RescueAgent 10 "{E5321DAA-ADE6-E7C9-A139-AE2FB1563242}" = Vectorworks 2010 Hilfe "{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger "{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support "{ECD03DA7-5952-406A-8156-5F0C93618D1F}" = Hama Webcam AC-150 "{EDCDFAD5-DF80-4600-A493-E9DAD6810230}" = Nero WaveEditor 10 "{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10 "{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F412B4AF-388C-4FF5-9B2F-33DB1C536953}" = Nero InfoTool 10 "{F467862A-D9CA-47ED-8D81-B4B3C9399272}" = Nero MediaHub 10 Help (CHM) "{F5CB822F-B365-43D1-BCC0-4FDA1A2017A7}" = Nero 10 Movie ThemePack Basic "{F6117F9C-ADB5-4590-9BE4-12C7BEC28702}" = Nero StartSmart 10 Help (CHM) "{F61D489E-6C44-49AC-AD02-7DA8ACA73A65}" = Nero StartSmart 10 "{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials "{FCF00A6E-FB58-477A-ABE9-232907105521}" = Nero CoverDesigner 10 "Adobe AIR" = Adobe AIR "Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin "Ashampoo Burning Studio 6 FREE_is1" = Ashampoo Burning Studio 6 FREE v.6.80 "Battlelog Web Plugins" = Battlelog Web Plugins "Call of Duty Modern Warfare 3 (c) Activision_is1" = Call of Duty Modern Warfare 3 (c) Activision version 1 "conduitEngine" = Conduit Engine "DAEMON Tools Lite" = DAEMON Tools Lite "DivX Setup" = DivX-Setup "Epson Printer Software Downloader" = Epson Printer Software Downloader "EPSON Scanner" = EPSON Scan "Epson Stylus SX210_SX410_TX210_TX410 Benutzerhandbuch" = Epson Stylus SX210_SX410_TX210_TX410 Handbuch "ESN Sonar-0.70.4" = ESN Sonar "eu.computerworks.vectorworks.2010.help.deu.C597E665C9D833B0F52B09434821DFAEF4904789.1" = Vectorworks 2010 Hilfe "grandMA onPC 6.616" = grandMA onPC 6.616 "grandMA2 onPC 2.4.3.2" = grandMA2 onPC 2.4.3.2 "InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver "loadtbs-2.1" = loadtbs-2.1 "LogMeIn Hamachi" = LogMeIn Hamachi "Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.0.1400 "Mozilla Firefox 15.0 (x86 en-US)" = Mozilla Firefox 15.0 (x86 en-US) "MozillaMaintenanceService" = Mozilla Maintenance Service "NIS" = Norton Internet Security "NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver "Origin" = Origin "PunkBusterSvc" = PunkBuster Services "Rechnung3" = Softwarenetz Rechnung3 "SFT_de3 Toolbar" = SFT_de3 Toolbar "Test Drive Unlimited 2_is1" = Test Drive Unlimited 2 "toolplugin" = toolplugin "UseNeXT_is1" = UseNeXT "Vectorworks Basic 2010 SP2 R1" = Vectorworks Basic 2010 SP2 R1 "VLC media player" = VLC media player 2.0.2 "WinLiveSuite" = Windows Live Essentials "ZOTAC FireStorm" = ZOTAC FireStorm ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Mozilla Firefox 15.0.1 (x86 en-US)" = Mozilla Firefox 15.0.1 (x86 en-US) ========== Last 20 Event Log Errors ========== [ Application Events ] Error - 09.09.2012 18:03:47 | Computer Name = Diseck-PC | Source = Bonjour Service | ID = 100 Description = Task Scheduling Error: m->NextScheduledEvent 8315 Error - 09.09.2012 18:03:47 | Computer Name = Diseck-PC | Source = Bonjour Service | ID = 100 Description = Task Scheduling Error: m->NextScheduledSPRetry 8315 Error - 09.09.2012 18:03:48 | Computer Name = Diseck-PC | Source = Bonjour Service | ID = 100 Description = Task Scheduling Error: Continuously busy for more than a second Error - 09.09.2012 18:03:48 | Computer Name = Diseck-PC | Source = Bonjour Service | ID = 100 Description = Task Scheduling Error: m->NextScheduledEvent 9329 Error - 09.09.2012 18:03:48 | Computer Name = Diseck-PC | Source = Bonjour Service | ID = 100 Description = Task Scheduling Error: m->NextScheduledSPRetry 9329 Error - 12.09.2012 18:25:08 | Computer Name = Diseck-PC | Source = Bonjour Service | ID = 100 Description = Task Scheduling Error: Continuously busy for more than a second Error - 12.09.2012 18:25:08 | Computer Name = Diseck-PC | Source = Bonjour Service | ID = 100 Description = Task Scheduling Error: m->NextScheduledEvent 9984 Error - 12.09.2012 18:25:08 | Computer Name = Diseck-PC | Source = Bonjour Service | ID = 100 Description = Task Scheduling Error: m->NextScheduledSPRetry 9984 Error - 12.09.2012 18:25:18 | Computer Name = Diseck-PC | Source = Bonjour Service | ID = 100 Description = Task Scheduling Error: Continuously busy for more than a second Error - 12.09.2012 18:25:18 | Computer Name = Diseck-PC | Source = Bonjour Service | ID = 100 Description = Task Scheduling Error: m->NextScheduledEvent 19984 [ System Events ] Error - 27.03.2012 01:45:36 | Computer Name = Diseck-PC | Source = Disk | ID = 262155 Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden. Error - 27.03.2012 01:45:37 | Computer Name = Diseck-PC | Source = Disk | ID = 262155 Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden. Error - 29.03.2012 15:18:44 | Computer Name = Diseck-PC | Source = ACPI | ID = 327693 Description = : Der eingebettete Controller (EC) hat nicht innerhalb des angegebenen Zeitlimits reagiert. Dies deutet auf einen Fehler in der EC-Hardware oder -Firmware hin bzw. darauf, dass das BIOS auf falsche Art auf den EC zugreift. Fragen Sie den Computerhersteller nach einem aktualisierten BIOS. Dieser Fehler kann in einigen Situationen zur Folge haben, dass der Computer fehlerhaft läuft. Error - 29.03.2012 16:12:51 | Computer Name = Diseck-PC | Source = volsnap | ID = 393252 Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte. Error - 01.04.2012 22:08:23 | Computer Name = Diseck-PC | Source = cdrom | ID = 262151 Description = Fehlerhafter Block bei Gerät \Device\CdRom0. Error - 01.04.2012 23:16:29 | Computer Name = Diseck-PC | Source = JRAID | ID = 262261 Description = Der Treiber für Gerät "\Device\Scsi\JRAID1" hat eine Portzeitüberschreitung aufgrund längerer mangelnder Aktivität ermittelt. Alle assoziierten Busse werden zurückgesetzt, um den Fehler zu beheben. Error - 02.04.2012 01:00:53 | Computer Name = Diseck-PC | Source = JRAID | ID = 262261 Description = Der Treiber für Gerät "\Device\Scsi\JRAID1" hat eine Portzeitüberschreitung aufgrund längerer mangelnder Aktivität ermittelt. Alle assoziierten Busse werden zurückgesetzt, um den Fehler zu beheben. Error - 02.04.2012 10:46:38 | Computer Name = Diseck-PC | Source = JRAID | ID = 262261 Description = Der Treiber für Gerät "\Device\Scsi\JRAID1" hat eine Portzeitüberschreitung aufgrund längerer mangelnder Aktivität ermittelt. Alle assoziierten Busse werden zurückgesetzt, um den Fehler zu beheben. Error - 02.04.2012 12:14:26 | Computer Name = Diseck-PC | Source = JRAID | ID = 262261 Description = Der Treiber für Gerät "\Device\Scsi\JRAID1" hat eine Portzeitüberschreitung aufgrund längerer mangelnder Aktivität ermittelt. Alle assoziierten Busse werden zurückgesetzt, um den Fehler zu beheben. Error - 03.04.2012 17:54:55 | Computer Name = Diseck-PC | Source = volsnap | ID = 393252 Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte. < End of report > OTL logfile created on: 13.09.2012 01:14:10 - Run 1 OTL by OldTimer - Version 3.2.61.3 Folder = H:\ 64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 2,17 Gb Available Physical Memory | 54,24% Memory free 7,99 Gb Paging File | 5,38 Gb Available in Paging File | 67,29% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 97,66 Gb Total Space | 6,40 Gb Free Space | 6,55% Space Free | Partition Type: NTFS Drive D: | 488,18 Gb Total Space | 199,85 Gb Free Space | 40,94% Space Free | Partition Type: NTFS Drive E: | 345,57 Gb Total Space | 183,08 Gb Free Space | 52,98% Space Free | Partition Type: NTFS Drive F: | 5,75 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF Drive H: | 7,44 Gb Total Space | 7,43 Gb Free Space | 99,86% Space Free | Partition Type: FAT32 Computer Name: DISECK-PC | User Name: Diseck | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - File not found PRC - H:\OTL.exe (OldTimer Tools) PRC - C:\ProgramData\QqKfUnJuwERq.exe (CQP) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) PRC - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.) PRC - C:\Program Files (x86)\Norton Internet Security\Engine\19.8.0.14\ccSvcHst.exe (Symantec Corporation) PRC - C:\Windows\SysWOW64\PnkBstrA.exe () PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation) PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) PRC - C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.) PRC - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - C:\Programme\ASUS\TurboV EVO\TurboV_EVO.exe (ASUSTeK Computer Inc.) PRC - C:\Programme\ASUS\TurboV EVO\TurboVHelp.exe (ASUSTeK Computer Inc.) PRC - C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.05\AsSysCtrlService.exe () PRC - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation) PRC - C:\Programme\ASUS\GPU Boost Driver\GpuBoostServer.exe ( ASUSTeK Computer Inc.) PRC - C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG) PRC - C:\Program Files (x86)\ASUS\AI Suite\QFan4\FanHelp.exe (ASUSTeK Computer Inc.) PRC - C:\Program Files (x86)\ASUS\EPU\EPU.exe ( ASUSTeK Computer Inc.) PRC - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe (DeviceVM, Inc.) PRC - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe (DeviceVM, Inc.) PRC - C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION) PRC - C:\Windows\DAODx.exe () PRC - C:\Windows\FixCamera.exe () PRC - C:\Windows\vsnpstd3.exe () PRC - C:\Windows\tsnpstd3.exe () ========== Modules (No Company Name) ========== MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll () MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll () MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll () MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () MOD - C:\Programme\ASUS\TurboV EVO\pngio.dll () MOD - C:\Programme\ASUS\TurboV EVO\flashobj.dll () MOD - C:\Programme\ASUS\TurboV EVO\HookKey32.dll () MOD - C:\Program Files (x86)\ASUS\EPU\pngio.dll () MOD - C:\Program Files (x86)\ASUS\EPU\AsSpindownTimeout.dll () MOD - C:\Windows\SysWOW64\AsIO.dll () MOD - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\sqlite3.dll () MOD - C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll () MOD - C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll () MOD - C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll () MOD - C:\Program Files (x86)\ASUS\EPU\ASUSSERVICE.DLL () MOD - C:\Windows\DAODx.exe () MOD - C:\PROGRA~2\EPSONS~1\EVENTM~1\ASSIST~1\SCANAS~1\SCANEN~1.DLL () MOD - C:\PROGRA~2\EPSONS~1\EVENTM~1\ASSIST~1\SCANAS~1\SATWAIN.dll () MOD - C:\Windows\FixCamera.exe () MOD - C:\Windows\vsnpstd3.exe () MOD - C:\Windows\tsnpstd3.exe () ========== Services (SafeList) ========== SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD) SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) SRV:64bit: - (hasplms) -- C:\Windows\SysNative\hasplms.exe (Aladdin Knowledge Systems Ltd.) SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) SRV - (MBAMScheduler) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (Skype C2C Service) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.) SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies) SRV - (NIS) -- C:\Program Files (x86)\Norton Internet Security\Engine\19.8.0.14\ccSvcHst.exe (Symantec Corporation) SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe () SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation) SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) SRV - (AsSysCtrlService) -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.05\AsSysCtrlService.exe () SRV - (NAUpdate) -- C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (BCUService) -- C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe (DeviceVM, Inc.) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation) DRV:64bit: - (SRTSPX) -- C:\Windows\SysNative\drivers\NISx64\1308000.00E\srtspx64.sys (Symantec Corporation) DRV:64bit: - (SRTSP) -- C:\Windows\SysNative\drivers\NISx64\1308000.00E\srtsp64.sys (Symantec Corporation) DRV:64bit: - (ccSet_NIS) -- C:\Windows\SysNative\drivers\NISx64\1308000.00E\ccsetx64.sys (Symantec Corporation) DRV:64bit: - (SymEFA) -- C:\Windows\SysNative\drivers\NISx64\1308000.00E\symefa64.sys (Symantec Corporation) DRV:64bit: - (SymNetS) -- C:\Windows\SysNative\drivers\NISx64\1308000.00E\symnets.sys (Symantec Corporation) DRV:64bit: - (SymIRON) -- C:\Windows\SysNative\drivers\NISx64\1308000.00E\ironx64.sys (Symantec Corporation) DRV:64bit: - (SymEvent) -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS (Symantec Corporation) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (dtsoftbus01) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys (DT Soft Ltd) DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.) DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation) DRV:64bit: - (SymDS) -- C:\Windows\SysNative\drivers\NISx64\1308000.00E\symds64.sys (Symantec Corporation) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek ) DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (Renesas Electronics Corporation) DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (Renesas Electronics Corporation) DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atipmdag.sys (ATI Technologies Inc.) DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.) DRV:64bit: - (AtiHdmiService) -- C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Technologies, Inc.) DRV:64bit: - (JRAID) -- C:\Windows\SysNative\drivers\jraid.sys (JMicron Technology Corp.) DRV:64bit: - (aksdf) -- C:\Windows\SysNative\drivers\aksdf.sys (Aladdin Knowledge Systems Ltd.) DRV:64bit: - (MTsensor) -- C:\Windows\SysNative\drivers\ASACPI.sys () DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.) DRV:64bit: - (AtiPcie) -- C:\Windows\SysNative\drivers\AtiPcie.sys (Advanced Micro Devices Inc.) DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.) DRV:64bit: - (hardlock) -- C:\Windows\SysNative\drivers\hardlock.sys (Aladdin Knowledge Systems Ltd.) DRV:64bit: - (aksfridge) -- C:\Windows\SysNative\drivers\aksfridge.sys (Aladdin Knowledge Systems Ltd.) DRV:64bit: - (SNPSTD3) -- C:\Windows\SysNative\drivers\snpstd3.sys (Sonix Co. Ltd.) DRV - (NAVEX15) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\VirusDefs\20120911.002\ex64.sys (Symantec Corporation) DRV - (NAVENG) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\VirusDefs\20120911.002\eng64.sys (Symantec Corporation) DRV - (IDSVia64) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\IPSDefs\20120908.001\IDSviA64.sys (Symantec Corporation) DRV - (BHDrvx64) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\BASHDefs\20120905.001\BHDrvx64.sys (Symantec Corporation) DRV - (eeCtrl) -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation) DRV - (EraserUtilRebootDrv) -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) DRV - (SNPSTD3) -- C:\Windows\SysWOW64\drivers\snpstd3.sys (Sonix Co. Ltd.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\URLSearchHook: {ff88a983-649d-4207-9336-9b999280b436} - C:\Program Files (x86)\SFT_de3\prxtbSFT_.dll (Conduit Ltd.) IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3031778 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 1E 10 DD AC 0F 82 CD 01 [binary data] IE - HKCU\..\URLSearchHook: {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll (DeviceVM, Inc.) IE - HKCU\..\URLSearchHook: {ff88a983-649d-4207-9336-9b999280b436} - C:\Program Files (x86)\SFT_de3\prxtbSFT_.dll (Conduit Ltd.) IE - HKCU\..\SearchScopes,DefaultScope = {219A0209-EFB1-450d-B86E-CC8F5A369719} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{219A0209-EFB1-450d-B86E-CC8F5A369719}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=EGMB IE - HKCU\..\SearchScopes\{5F70BF71-5042-4d6e-98D2-E6908CD6CCA4}: "URL" = hxxp://www.google.com/custom?client=pub-3794288947762788&forid=1&channel=5369970905&ie=UTF-8&oe=UTF-8&safe=active&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF %3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A1&hl=de&q={searchTerms} IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3031778 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Search the web" FF - prefs.js..browser.search.order.1: "Search the web" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.startup.homepage: "google.de" FF - prefs.js..extensions.enabledAddons: software@loadtubes.com:1.01 FF - prefs.js..extensions.enabledAddons: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.2.145 FF - prefs.js..keyword.URL: "hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q=" FF - user.js..browser.search.selectedEngine: "Search the web" FF - user.js..browser.search.order.1: "Search the web" FF - user.js..browser.search.defaultenginename: "Search the web" FF - user.js..keyword.URL: "hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q=" FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_271.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_271.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.116.0: C:\Program Files (x86)\Battlelog Web Plugins\1.116.0\npesnlaunch.dll File not found FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.122.0: C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\IPSFFPlgn\ [2012.03.13 21:24:18 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\coFFPlgn\ [2012.09.12 23:22:21 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.02.16 01:46:49 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.09.07 22:24:08 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.09.07 22:24:06 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.09.07 22:24:08 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.09.07 22:24:06 | 000,000,000 | ---D | M] [2011.12.21 00:15:06 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Diseck\AppData\Roaming\mozilla\Extensions [2012.08.21 17:48:29 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Diseck\AppData\Roaming\mozilla\Firefox\Profiles\sg49yi49.default\extensions [2012.08.21 17:48:29 | 000,000,000 | -H-D | M] (SFT_de3 Community Toolbar) -- C:\Users\Diseck\AppData\Roaming\mozilla\Firefox\Profiles\sg49yi49.default\extensions\{ff88a983-649d-4207-9336-9b999280b436} [2012.04.10 23:54:57 | 000,000,000 | -H-D | M] (loadtbs) -- C:\Users\Diseck\AppData\Roaming\mozilla\Firefox\Profiles\sg49yi49.default\extensions\software@loadtubes.com [2012.02.04 02:22:38 | 000,000,000 | -H-D | M] (Ask Toolbar) -- C:\Users\Diseck\AppData\Roaming\mozilla\Firefox\Profiles\sg49yi49.default\extensions\toolbar@ask.com [2012.02.15 22:55:08 | 000,000,000 | -H-D | M] (toolplugin) -- C:\Users\Diseck\AppData\Roaming\mozilla\Firefox\Profiles\sg49yi49.default\extensions\welcome@toolmin.com [2012.09.07 22:24:06 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012.09.07 22:24:06 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012.02.16 01:46:49 | 000,000,000 | ---D | M] (DivX Plus Web Player HTML5 <video>  -- C:\PROGRAM FILES (X86)\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5[2012.09.07 22:24:08 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2012.02.15 16:48:02 | 000,378,880 | ---- | M] (InfiniAd GmbH) -- C:\Program Files (x86)\mozilla firefox\plugins\npmieze.dll [2012.09.02 16:05:13 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012.02.15 22:55:08 | 000,000,158 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\Search the web.src [2012.09.02 16:05:13 | 000,002,253 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngin.dll (Conduit Ltd.) O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\19.8.0.14\coIEPlg.dll (Symantec Corporation) O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\19.8.0.14\IPS\IPSBHO.DLL (Symantec Corporation) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask.com) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (SFT_de3 Toolbar) - {ff88a983-649d-4207-9336-9b999280b436} - C:\Program Files (x86)\SFT_de3\prxtbSFT_.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngin.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\19.8.0.14\coIEPlg.dll (Symantec Corporation) O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask.com) O3 - HKLM\..\Toolbar: (loadtbs) - {DFEFCDEE-CF1A-4FC8-88AD-129872198372} - C:\Users\Diseck\AppData\Roaming\loadtbs\toolbar.dll (InfiniAd GmbH) O3 - HKLM\..\Toolbar: (toolplugin) - {DFEFCDEE-CF1A-4FC8-89AF-189327213627} - C:\Users\Diseck\AppData\Roaming\toolplugin\toolbar.dll () O3 - HKLM\..\Toolbar: (SFT_de3 Toolbar) - {ff88a983-649d-4207-9336-9b999280b436} - C:\Program Files (x86)\SFT_de3\prxtbSFT_.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\19.8.0.14\coIEPlg.dll (Symantec Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask.com) O3 - HKCU\..\Toolbar\WebBrowser: (SFT_de3 Toolbar) - {FF88A983-649D-4207-9336-9B999280B436} - C:\Program Files (x86)\SFT_de3\prxtbSFT_.dll (Conduit Ltd.) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4:64bit: - HKLM..\Run: [snpstd3] C:\Windows\vsnpstd3.exe () O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [BCU] C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe (DeviceVM, Inc.) O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () O4 - HKLM..\Run: [EEventManager] C:\PROGRA~2\EPSONS~1\EVENTM~1\EEventManager.exe (SEIKO EPSON CORPORATION) O4 - HKLM..\Run: [FixCamera] C:\Windows\FixCamera.exe () O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe () O4 - HKLM..\Run: [LogMeIn Hamachi Ui] "E:\Games\hamachi-2-ui.exe" --auto-start File not found O4 - HKLM..\Run: [NBAgent] C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe (Nero AG) O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation) O4 - HKLM..\Run: [QFan Help] C:\Program Files (x86)\ASUS\AI Suite\QFan4\FanHelp.exe (ASUSTeK Computer Inc.) O4 - HKLM..\Run: [Six Engine] C:\Program Files (x86)\ASUS\EPU\EPU.exe ( ASUSTeK Computer Inc.) O4 - HKLM..\Run: [snpstd3] C:\Windows\vsnpstd3.exe () O4 - HKLM..\Run: [tsnpstd3] C:\Windows\tsnpstd3.exe () O4 - HKLM..\Run: [TurboV EVO] C:\Program Files\ASUS\TurboV EVO\TurboV_EVO.exe (ASUSTeK Computer Inc.) O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) O4 - HKCU..\Run: [EPSON SX210 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIFDE.EXE /FU "C:\Windows\TEMP\E_S9E84.tmp" /EF "HKCU" File not found O4 - HKCU..\Run: [jipudqbw] C:\Users\Diseck\AppData\Local\hpidhalm.exe (SIIG, Inc.) O4 - HKCU..\Run: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.) O4 - HKCU..\Run: [nbxlbdib] C:\Users\Diseck\AppData\Local\hpidhalm.exe (SIIG, Inc.) O4 - HKCU..\Run: [QqKfUnJuwERq.exe] C:\ProgramData\QqKfUnJuwERq.exe (CQP) O4 - HKCU..\Run: [xawnaakp] C:\Users\Diseck\AppData\Local\awphddcn.exe (SIIG, Inc.) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 0 O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{01645BFC-4730-4BF4-A457-2D40CE30E6ED}: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation) O20 - HKCU Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.07.14 11:29:38 | 000,000,122 | R--- | M] () - F:\autorun.inf -- [ UDF ] O33 - MountPoints2\{111c5bcd-2b1b-11e1-a82d-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{111c5bcd-2b1b-11e1-a82d-806e6f6e6963}\Shell\AutoRun\command - "" = F:\Autorun.exe O33 - MountPoints2\{4e36f707-2b12-11e1-b7c2-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{4e36f707-2b12-11e1-b7c2-806e6f6e6963}\Shell\AutoRun\command - "" = F:\.\Bin\ASSETUP.exe O33 - MountPoints2\{b3a47061-5d5f-11e1-ba86-20cf305acc61}\Shell - "" = AutoRun O33 - MountPoints2\{b3a47061-5d5f-11e1-ba86-20cf305acc61}\Shell\AutoRun\command - "" = G:\Autorun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.09.12 23:31:31 | 000,000,000 | ---D | C] -- C:\Users\Diseck\AppData\Roaming\Malwarebytes [2012.09.12 23:31:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.09.12 23:31:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.09.12 23:31:26 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.09.12 23:31:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2012.09.12 23:23:00 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{0A806097-9621-46EA-ADEF-BC0858546C8B} [2012.09.11 23:13:01 | 000,278,016 | -H-- | C] (CQP) -- C:\ProgramData\lN4g81Fi3fHQ6c.exe [2012.09.11 22:59:57 | 000,380,416 | -H-- | C] (CQP) -- C:\ProgramData\QqKfUnJuwERq.exe [2012.09.11 22:57:57 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{CA561361-D402-4A77-AC55-7C6A6EC45804} [2012.09.10 21:16:49 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{7614E840-B385-46AD-B0DF-1B78848CF1F4} [2012.09.10 08:51:47 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{1CFA2A96-3251-4F48-95D2-3E5E6AD9B8F2} [2012.09.09 16:24:34 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{3980F12C-656A-43EE-95D1-E986A74F4FA6} [2012.09.07 22:24:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2012.09.07 20:45:38 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{949EAA69-DBD8-4F56-830B-813638BE75EE} [2012.09.07 07:53:17 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{971F6D43-3BF1-46DB-9B89-6428E772A529} [2012.09.06 16:01:27 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{5C990785-DB68-458A-8BF9-86B2B4D6D258} [2012.09.05 23:19:15 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{4D854A1B-48A5-42B0-9428-217309A57C96} [2012.09.04 21:09:36 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{E256DF5F-0D7C-4ABB-AF6B-F6AC5ABA5D5C} [2012.09.04 08:54:30 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{D13C1875-A210-4D7E-A989-AA6506699BE0} [2012.09.03 20:31:29 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{9F2A058F-9036-4230-B662-960437218C42} [2012.09.03 08:27:29 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{8BD0E2D1-87B2-44C5-8098-EA41C8408C4E} [2012.09.02 16:04:02 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{CAE9492B-2A45-4DD0-ACE9-306ABF740DC4} [2012.09.02 02:22:52 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{8868E99D-5C9E-449A-B148-B80C652058D5} [2012.09.01 14:22:25 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{D6785F46-81D4-437E-94DA-3188DF57FD83} [2012.08.31 15:04:41 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{CB0EFF37-2309-4620-BECA-E5FAD45BB8AC} [2012.08.30 17:15:26 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\appmgmt [2012.08.30 16:53:29 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{CC85F00B-8114-42F2-BBE5-34BF278A3DD2} [2012.08.30 16:53:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi [2012.08.30 03:32:02 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{4908FCCC-5A3B-45DE-ABFB-18ECA479C24E} [2012.08.30 03:11:32 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{8A04626F-DF3D-450F-9A6B-57A0556ECF7C} [2012.08.27 21:42:20 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{9BAFE2D7-131F-4C30-A689-5C3A0871AAA0} [2012.08.27 17:19:51 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{46E80FC6-B892-46FC-A4BC-7CDC99E3C30E} [2012.08.27 00:25:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VID_0E8F&PID_0003 [2012.08.27 00:11:58 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{EE8731D8-0435-4914-B4C3-0E1F9077F7DD} [2012.08.26 15:21:04 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\Documents\Eden Games [2012.08.26 15:18:58 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\CrashRpt [2012.08.26 01:16:31 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{7AF1357A-844C-46EB-80E4-C6047089D43A} [2012.08.24 23:54:42 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{ED67B027-5092-4640-AC0B-14328A19ACF0} [2012.08.24 19:25:56 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\Macromedia [2012.08.24 18:03:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Atari [2012.08.24 17:50:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service [2012.08.24 17:48:34 | 000,426,184 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2012.08.24 07:49:49 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{408A675C-154A-41BC-890B-12766DC666DB} [2012.08.23 12:19:51 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{67AEAA0E-E09A-46F7-941D-9EBBC2A81ED2} [2012.08.21 21:35:27 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{4063671E-2AA3-49B7-A238-0151D2D98A6D} [2012.08.21 02:50:07 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{0C20C1A8-4519-4342-BC12-9D6B66E26DD7} [2012.08.20 14:25:44 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{A31AD4E3-6882-42F9-BAA4-9325A23DD773} [2012.08.19 21:39:41 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{7166C226-A3D4-4844-AD77-A22FCADA3AEF} [2012.08.19 10:20:20 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{C5B456E7-FEA8-478B-AD08-C64F5199138E} [2012.08.18 12:47:26 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{A026FCD6-C9A2-44E4-BADD-A0AA34606160} [2012.08.18 12:47:14 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{3649FC59-F432-4869-B6CD-1E8DC5ABCBC3} [2012.08.17 19:54:25 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{65636FF2-ADEF-4067-9F34-7F547EE2F73C} [2012.08.17 19:54:15 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{1A02F06E-3603-44D0-8FA3-E3DD2053F9BE} [2012.08.17 01:47:38 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{598AFDB9-82C2-4007-AB88-8682A8674CE5} [2012.08.17 01:47:27 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{F7917EA7-3A85-4588-8DF4-2F5DF9B26A57} [2012.08.16 07:25:56 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{26BA177C-65D6-4985-895C-2A2609926438} [2012.08.16 07:25:45 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{1A1A5698-9B6B-4D3C-834B-338CFD1040AA} [2012.08.15 03:00:47 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2012.08.15 03:00:47 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2012.08.15 03:00:47 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2012.08.15 03:00:47 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2012.08.15 03:00:46 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2012.08.15 03:00:46 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2012.08.15 03:00:46 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2012.08.15 03:00:46 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe [2012.08.15 03:00:46 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2012.08.15 03:00:45 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2012.08.15 03:00:45 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2012.08.15 03:00:45 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2012.08.15 03:00:44 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2012.08.15 02:57:21 | 000,503,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\srcore.dll [2012.08.15 02:57:19 | 000,751,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll [2012.08.15 02:57:19 | 000,492,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll [2012.08.15 02:57:19 | 000,067,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\splwow64.exe [2012.08.15 02:57:18 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netapi32.dll [2012.08.15 02:57:18 | 000,058,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\browcli.dll [2012.08.15 02:57:18 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\browcli.dll [2012.08.15 02:57:16 | 000,956,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\localspl.dll [2012.08.15 02:52:04 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{A137E8FD-1760-4D27-9658-8B09C4BB3191} [2012.08.15 02:51:46 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{97060FBA-D952-4DFC-83CC-DFFA1F24CD9B} [2012.08.08 18:14:26 | 000,071,168 | -H-- | C] (SIIG, Inc.) -- C:\Users\Diseck\AppData\Local\awphddcn.exe [2012.08.08 18:13:59 | 000,071,168 | -H-- | C] (SIIG, Inc.) -- C:\Users\Diseck\AppData\Local\hpidhalm.exe [2007.08.13 18:46:00 | 000,102,912 | -H-- | C] (Albert L Faber) -- C:\Users\Diseck\AppData\Local\CDRip.dll [2007.01.18 22:09:54 | 000,623,616 | -H-- | C] (Ivan Bischof ©2003 - 2005) -- C:\Users\Diseck\AppData\Local\No23 Recorder.exe [2006.12.11 20:13:14 | 000,013,872 | -H-- | C] (Un4seen Developments) -- C:\Users\Diseck\AppData\Local\basscd.dll [2006.12.11 20:13:12 | 000,097,336 | -H-- | C] (Un4seen Developments) -- C:\Users\Diseck\AppData\Local\bass.dll [1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.09.13 01:18:22 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.09.13 00:25:55 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.09.12 23:31:33 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.09.12 23:31:33 | 000,654,150 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.09.12 23:31:33 | 000,616,032 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.09.12 23:31:33 | 000,130,022 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.09.12 23:31:33 | 000,106,412 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.09.12 23:31:28 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.09.12 23:31:06 | 000,018,816 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.09.12 23:31:06 | 000,018,816 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.09.12 23:22:05 | 3219,791,872 | -HS- | M] () -- C:\hiberfil.sys [2012.09.12 00:13:39 | 000,380,416 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\jfemgpvq.exe [2012.09.11 23:13:19 | 000,000,112 | -H-- | M] () -- C:\ProgramData\lN4g81Fi3fHQ6c [2012.09.11 23:13:01 | 000,278,016 | -H-- | M] (CQP) -- C:\ProgramData\lN4g81Fi3fHQ6c.exe [2012.09.11 22:57:20 | 000,380,416 | -H-- | M] (CQP) -- C:\ProgramData\QqKfUnJuwERq.exe [2012.09.11 22:57:15 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\nvjqxxrf [2012.09.11 07:49:26 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\srqhqhga [2012.09.10 22:49:58 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\gajqewcl [2012.09.10 21:16:23 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\qrmmbeqi [2012.09.10 08:51:44 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\rjudvgwt [2012.09.09 16:24:15 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\ixcgowmx [2012.09.08 13:55:18 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\cfhxhkng [2012.09.07 20:45:22 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\sfqtvwvg [2012.09.07 17:04:46 | 000,025,928 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.09.06 20:52:38 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\ffgvhpfq [2012.09.06 16:01:35 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\wtqhfwnf [2012.09.05 23:19:14 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\nnocvtbl [2012.09.04 21:10:11 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\ldnujfdh [2012.09.03 21:43:50 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\ccjoetux [2012.09.03 20:31:35 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\wdajqqsp [2012.09.02 16:03:56 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\mhokdnuw [2012.09.01 14:22:29 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\usipaceh [2012.08.31 15:23:00 | 000,000,254 | ---- | M] () -- C:\Windows\tasks\Epson Printer Software Downloader.job [2012.08.31 15:04:35 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\sppkauuw [2012.08.31 00:11:25 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\kxlrinlq [2012.08.30 16:57:06 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\gwtdjdnv [2012.08.30 16:52:36 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\gxaifewv [2012.08.30 03:37:11 | 000,283,304 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr [2012.08.30 03:37:11 | 000,283,304 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe [2012.08.29 21:08:58 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\pnusprao [2012.08.29 18:57:54 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\wxrvdbnd [2012.08.29 16:07:04 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\hcvgdtup [2012.08.29 15:46:42 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\jknoxhjh [2012.08.29 05:24:14 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\qmlaqoaw [2012.08.28 13:07:14 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\ecehjngf [2012.08.27 22:52:37 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\wwvhjnup [2012.08.26 18:06:21 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\ledgaeqn [2012.08.26 01:16:07 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\ngahoagv [2012.08.24 18:18:55 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2012.08.24 18:18:55 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2012.08.24 17:50:19 | 000,001,130 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2012.08.24 16:45:36 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\pbomxtej [2012.08.24 07:50:04 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\bkjexcbc [2012.08.23 14:38:08 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\lnqaxxsb [2012.08.21 09:40:47 | 000,059,904 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\bucopatf [2012.08.17 01:47:07 | 000,237,634 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\tdsrexct.exe [2012.08.16 14:00:46 | 000,059,904 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\nxonvsqq [2012.08.16 07:35:45 | 000,008,942 | ---- | M] () -- C:\Windows\SysNative\drivers\NISx64\1308000.00E\VT20120731.038 [2012.08.16 07:24:03 | 002,040,616 | ---- | M] () -- C:\Windows\SysNative\drivers\NISx64\1308000.00E\Cat.DB [2012.08.15 12:15:39 | 000,059,904 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\mdhnomdv [2012.08.15 05:59:11 | 000,267,704 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.08.14 08:37:59 | 000,059,904 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\pvrjupvt [1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.09.12 23:31:28 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.09.12 00:13:32 | 000,380,416 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\jfemgpvq.exe [2012.09.11 23:13:19 | 000,000,112 | -H-- | C] () -- C:\ProgramData\lN4g81Fi3fHQ6c [2012.09.11 22:57:15 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\nvjqxxrf [2012.09.11 07:49:26 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\srqhqhga [2012.09.10 22:49:58 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\gajqewcl [2012.09.10 21:16:23 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\qrmmbeqi [2012.09.10 08:51:44 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\rjudvgwt [2012.09.09 16:24:15 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\ixcgowmx [2012.09.08 13:55:18 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\cfhxhkng [2012.09.07 20:45:22 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\sfqtvwvg [2012.09.06 20:52:38 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\ffgvhpfq [2012.09.06 16:01:35 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\wtqhfwnf [2012.09.05 23:19:14 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\nnocvtbl [2012.09.04 21:10:11 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\ldnujfdh [2012.09.03 21:43:50 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\ccjoetux [2012.09.03 20:31:35 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\wdajqqsp [2012.09.02 16:03:56 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\mhokdnuw [2012.09.01 14:22:29 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\usipaceh [2012.08.31 15:04:35 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\sppkauuw [2012.08.31 00:11:25 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\kxlrinlq [2012.08.30 16:57:06 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\gwtdjdnv [2012.08.30 16:52:36 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\gxaifewv [2012.08.29 21:08:58 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\pnusprao [2012.08.29 18:57:54 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\wxrvdbnd [2012.08.29 16:07:04 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\hcvgdtup [2012.08.29 15:46:42 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\jknoxhjh [2012.08.29 05:24:14 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\qmlaqoaw [2012.08.28 13:07:14 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\ecehjngf [2012.08.27 22:52:37 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\wwvhjnup [2012.08.26 18:06:21 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\ledgaeqn [2012.08.26 01:16:07 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\ngahoagv [2012.08.24 17:50:18 | 000,001,130 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2012.08.24 17:50:10 | 000,001,142 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2012.08.24 17:48:40 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.08.24 16:45:36 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\pbomxtej [2012.08.24 07:50:04 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\bkjexcbc [2012.08.23 14:38:08 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\lnqaxxsb [2012.08.21 09:40:47 | 000,059,904 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\bucopatf [2012.08.17 01:47:03 | 000,237,634 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\tdsrexct.exe [2012.08.16 14:00:46 | 000,059,904 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\nxonvsqq [2012.08.15 12:15:39 | 000,059,904 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\mdhnomdv [2012.08.14 08:37:59 | 000,059,904 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\pvrjupvt [2012.08.13 19:50:35 | 000,060,416 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\vikaxulk [2012.08.12 15:57:16 | 000,060,416 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\wbcafdnh [2012.08.11 12:11:17 | 000,059,904 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\iencaxbe [2012.08.10 21:24:31 | 000,060,416 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\dakuxlcc [2012.08.09 23:41:47 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\tsnntubj [2012.08.08 18:15:10 | 000,058,880 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\hljipudq [2012.08.08 18:14:33 | 000,000,000 | -H-- | C] () -- C:\Users\Diseck\AppData\Roaming\SharedSettings.ccs [2012.06.19 01:14:52 | 000,020,480 | ---- | C] () -- C:\Windows\FixCamera.exe [2012.06.19 01:14:39 | 000,835,584 | ---- | C] () -- C:\Windows\vsnpstd3.exe [2012.06.19 01:14:39 | 000,270,336 | ---- | C] () -- C:\Windows\tsnpstd3.exe [2012.06.19 01:14:39 | 000,015,498 | ---- | C] () -- C:\Windows\snpstd3.ini [2012.06.19 01:14:38 | 000,155,648 | ---- | C] ( ) -- C:\Windows\SysWow64\rsnpstd3.dll [2012.06.19 01:14:38 | 000,057,344 | ---- | C] ( ) -- C:\Windows\SysWow64\vsnpstd3.dll [2012.06.19 01:14:38 | 000,053,248 | ---- | C] ( ) -- C:\Windows\csnpstd3.dll [2012.03.16 02:20:41 | 000,007,651 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\Resmon.ResmonCfg [2012.02.29 14:26:56 | 000,416,064 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe [2011.12.29 21:43:56 | 000,001,459 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\RecConfig.xml [2011.12.21 16:16:39 | 000,111,932 | ---- | C] () -- C:\Windows\SysWow64\EPPICPrinterDB.dat [2011.12.21 16:16:39 | 000,031,053 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern131.dat [2011.12.21 16:16:39 | 000,027,417 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern121.dat [2011.12.21 16:16:39 | 000,026,154 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern1.dat [2011.12.21 16:16:39 | 000,024,903 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern3.dat [2011.12.21 16:16:39 | 000,021,390 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern5.dat [2011.12.21 16:16:39 | 000,020,148 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern2.dat [2011.12.21 16:16:39 | 000,011,811 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern4.dat [2011.12.21 16:16:39 | 000,004,943 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern6.dat [2011.12.21 16:16:39 | 000,001,146 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_DU.dat [2011.12.21 16:16:39 | 000,001,139 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_PT.dat [2011.12.21 16:16:39 | 000,001,139 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_BP.dat [2011.12.21 16:16:39 | 000,001,136 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_ES.dat [2011.12.21 16:16:39 | 000,001,129 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_FR.dat [2011.12.21 16:16:39 | 000,001,129 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_CF.dat [2011.12.21 16:16:39 | 000,001,120 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_IT.dat [2011.12.21 16:16:39 | 000,001,107 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_GE.dat [2011.12.21 16:16:39 | 000,001,104 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_EN.dat [2011.12.21 16:16:39 | 000,000,097 | ---- | C] () -- C:\Windows\SysWow64\PICSDK.ini [2011.12.21 00:41:30 | 000,283,304 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2011.12.21 00:41:29 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe [2011.12.21 00:41:28 | 002,434,856 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_bc2.exe [2011.12.20 16:58:41 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2011.12.20 16:43:18 | 000,024,576 | R--- | C] () -- C:\Windows\SysWow64\AsIO.dll [2011.12.20 16:43:18 | 000,013,440 | R--- | C] () -- C:\Windows\SysWow64\drivers\AsIO.sys [2011.12.20 16:43:15 | 000,011,832 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp64.sys [2011.12.20 16:43:15 | 000,010,216 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp32.sys [2011.12.20 16:40:55 | 000,001,035 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat [2011.12.20 16:34:36 | 000,048,278 | ---- | C] () -- C:\Windows\Ascd_log.ini [2011.12.20 16:33:25 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini [2011.12.20 16:33:19 | 000,032,976 | ---- | C] () -- C:\Windows\Ascd_tmp.ini [2007.08.13 18:46:00 | 000,155,136 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\lame_enc.dll [2006.10.26 02:06:48 | 000,064,000 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\vorbisenc.dll [2006.10.26 02:06:48 | 000,019,456 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\vorbisfile.dll [2006.10.26 02:06:46 | 000,143,872 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\vorbis.dll [2006.10.26 02:06:36 | 000,015,872 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\ogg.dll [2005.08.23 23:34:06 | 000,029,184 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\no23xwrapper.dll |
|
13.09.2012, 06:46
| #2 |
  | System Message - Write Fault Error / system error hard disk failure detected Hi,
__________________alle Funde von MAM bereinigen lassen (Log posten), neu Booten und ein neues OTL-Log erstellen und per Code-Tags hier posten... chris
__________________ |
|
13.09.2012, 13:46
| #3 |
| | System Message - Write Fault Error / system error hard disk failure detected Hallo,
__________________danke für die schnelle Antwort!!! hier ist der neue Log:OTL Logfile: Code:
ATTFilter OTL logfile created on: 13.09.2012 15:12:32 - Run 2 OTL by OldTimer - Version 3.2.61.3 Folder = H:\ 64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 2,22 Gb Available Physical Memory | 55,64% Memory free 7,99 Gb Paging File | 6,33 Gb Available in Paging File | 79,13% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 97,66 Gb Total Space | 6,41 Gb Free Space | 6,56% Space Free | Partition Type: NTFS Drive D: | 488,18 Gb Total Space | 199,85 Gb Free Space | 40,94% Space Free | Partition Type: NTFS Drive E: | 345,57 Gb Total Space | 183,08 Gb Free Space | 52,98% Space Free | Partition Type: NTFS Drive F: | 5,75 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF Drive H: | 7,44 Gb Total Space | 7,43 Gb Free Space | 99,86% Space Free | Partition Type: FAT32 Computer Name: DISECK-PC | User Name: Diseck | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - File not found PRC - H:\OTL.exe (OldTimer Tools) PRC - C:\ProgramData\QqKfUnJuwERq.exe (CQP) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) PRC - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.) PRC - C:\Program Files (x86)\Norton Internet Security\Engine\19.8.0.14\ccSvcHst.exe (Symantec Corporation) PRC - C:\Windows\SysWOW64\PnkBstrA.exe () PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation) PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) PRC - C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.) PRC - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - C:\Programme\ASUS\TurboV EVO\TurboV_EVO.exe (ASUSTeK Computer Inc.) PRC - C:\Programme\ASUS\TurboV EVO\TurboVHelp.exe (ASUSTeK Computer Inc.) PRC - C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.05\AsSysCtrlService.exe () PRC - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation) PRC - C:\Programme\ASUS\GPU Boost Driver\GpuBoostServer.exe ( ASUSTeK Computer Inc.) PRC - C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG) PRC - C:\Program Files (x86)\ASUS\AI Suite\QFan4\FanHelp.exe (ASUSTeK Computer Inc.) PRC - C:\Program Files (x86)\ASUS\EPU\EPU.exe ( ASUSTeK Computer Inc.) PRC - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe (DeviceVM, Inc.) PRC - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe (DeviceVM, Inc.) PRC - C:\Windows\SysWOW64\attrib.exe (Microsoft Corporation) PRC - C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION) PRC - C:\Windows\DAODx.exe () PRC - C:\Windows\FixCamera.exe () PRC - C:\Windows\vsnpstd3.exe () PRC - C:\Windows\tsnpstd3.exe () ========== Modules (No Company Name) ========== MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll () MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll () MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll () MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () MOD - C:\Programme\ASUS\TurboV EVO\pngio.dll () MOD - C:\Programme\ASUS\TurboV EVO\flashobj.dll () MOD - C:\Programme\ASUS\TurboV EVO\HookKey32.dll () MOD - C:\Program Files (x86)\ASUS\EPU\pngio.dll () MOD - C:\Program Files (x86)\ASUS\EPU\AsSpindownTimeout.dll () MOD - C:\Windows\SysWOW64\AsIO.dll () MOD - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\sqlite3.dll () MOD - C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll () MOD - C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll () MOD - C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll () MOD - C:\Program Files (x86)\ASUS\EPU\ASUSSERVICE.DLL () MOD - C:\Windows\DAODx.exe () MOD - C:\PROGRA~2\EPSONS~1\EVENTM~1\ASSIST~1\SCANAS~1\SCANEN~1.DLL () MOD - C:\PROGRA~2\EPSONS~1\EVENTM~1\ASSIST~1\SCANAS~1\SATWAIN.dll () MOD - C:\Windows\FixCamera.exe () MOD - C:\Windows\vsnpstd3.exe () MOD - C:\Windows\tsnpstd3.exe () ========== Services (SafeList) ========== SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD) SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) SRV:64bit: - (hasplms) -- C:\Windows\SysNative\hasplms.exe (Aladdin Knowledge Systems Ltd.) SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) SRV - (MBAMScheduler) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (Skype C2C Service) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.) SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies) SRV - (NIS) -- C:\Program Files (x86)\Norton Internet Security\Engine\19.8.0.14\ccSvcHst.exe (Symantec Corporation) SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe () SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation) SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) SRV - (AsSysCtrlService) -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.05\AsSysCtrlService.exe () SRV - (NAUpdate) -- C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (BCUService) -- C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe (DeviceVM, Inc.) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) ========== Driver Services (All) ========== DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation) DRV:64bit: - (SRTSPX) -- C:\Windows\SysNative\drivers\NISx64\1308000.00E\srtspx64.sys (Symantec Corporation) DRV:64bit: - (SRTSP) -- C:\Windows\SysNative\drivers\NISx64\1308000.00E\srtsp64.sys (Symantec Corporation) DRV:64bit: - (ccSet_NIS) -- C:\Windows\SysNative\drivers\NISx64\1308000.00E\ccsetx64.sys (Symantec Corporation) DRV:64bit: - (KSecDD) -- C:\Windows\SysNative\drivers\ksecdd.sys (Microsoft Corporation) DRV:64bit: - (KSecPkg) -- C:\Windows\SysNative\drivers\ksecpkg.sys (Microsoft Corporation) DRV:64bit: - (CNG) -- C:\Windows\SysNative\drivers\cng.sys (Microsoft Corporation) DRV:64bit: - (SymEFA) -- C:\Windows\SysNative\drivers\NISx64\1308000.00E\symefa64.sys (Symantec Corporation) DRV:64bit: - (RDPWD) -- C:\Windows\SysNative\drivers\rdpwd.sys (Microsoft Corporation) DRV:64bit: - (SymNetS) -- C:\Windows\SysNative\drivers\NISx64\1308000.00E\symnets.sys (Symantec Corporation) DRV:64bit: - (SymIRON) -- C:\Windows\SysNative\drivers\NISx64\1308000.00E\ironx64.sys (Symantec Corporation) DRV:64bit: - (TCPIP6) -- C:\Windows\SysNative\drivers\tcpip.sys (Microsoft Corporation) DRV:64bit: - (Tcpip) -- C:\Windows\SysNative\drivers\tcpip.sys (Microsoft Corporation) DRV:64bit: - (SymEvent) -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS (Symantec Corporation) DRV:64bit: - (partmgr) -- C:\Windows\SysNative\drivers\partmgr.sys (Microsoft Corporation) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (nvlddmkm) -- C:\Windows\SysNative\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV:64bit: - (dtsoftbus01) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys (DT Soft Ltd) DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.) DRV:64bit: - (TDTCP) -- C:\Windows\SysNative\drivers\tdtcp.sys (Microsoft Corporation) DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation) DRV:64bit: - (AFD) -- C:\Windows\SysNative\drivers\afd.sys (Microsoft Corporation) DRV:64bit: - (SymDS) -- C:\Windows\SysNative\drivers\NISx64\1308000.00E\symds64.sys (Symantec Corporation) DRV:64bit: - (mrxsmb10) -- C:\Windows\SysNative\drivers\mrxsmb10.sys (Microsoft Corporation) DRV:64bit: - (mrxsmb) -- C:\Windows\SysNative\drivers\mrxsmb.sys (Microsoft Corporation) DRV:64bit: - (mrxsmb20) -- C:\Windows\SysNative\drivers\mrxsmb20.sys (Microsoft Corporation) DRV:64bit: - (srv) -- C:\Windows\SysNative\drivers\srv.sys (Microsoft Corporation) DRV:64bit: - (srv2) -- C:\Windows\SysNative\drivers\srv2.sys (Microsoft Corporation) DRV:64bit: - (srvnet) -- C:\Windows\SysNative\drivers\srvnet.sys (Microsoft Corporation) DRV:64bit: - (DfsC) -- C:\Windows\SysNative\drivers\dfsc.sys (Microsoft Corporation) DRV:64bit: - (usbhub) -- C:\Windows\SysNative\drivers\usbhub.sys (Microsoft Corporation) DRV:64bit: - (usbccgp) -- C:\Windows\SysNative\drivers\usbccgp.sys (Microsoft Corporation) DRV:64bit: - (usbehci) -- C:\Windows\SysNative\drivers\usbehci.sys (Microsoft Corporation) DRV:64bit: - (usbohci) -- C:\Windows\SysNative\drivers\usbohci.sys (Microsoft Corporation) DRV:64bit: - (usbuhci) -- C:\Windows\SysNative\drivers\usbuhci.sys (Microsoft Corporation) DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\drivers\ntfs.sys (Microsoft Corporation) DRV:64bit: - (nvstor) -- C:\Windows\SysNative\drivers\nvstor.sys (NVIDIA Corporation) DRV:64bit: - (nvraid) -- C:\Windows\SysNative\drivers\nvraid.sys (NVIDIA Corporation) DRV:64bit: - (iaStorV) -- C:\Windows\SysNative\drivers\iaStorV.sys (Intel Corporation) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (USBSTOR) -- C:\Windows\SysNative\drivers\USBSTOR.SYS (Microsoft Corporation) DRV:64bit: - (bowser) -- C:\Windows\SysNative\drivers\bowser.sys (Microsoft Corporation) DRV:64bit: - (DXGKrnl) -- C:\Windows\SysNative\drivers\dxgkrnl.sys (Microsoft Corporation) DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek ) DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (Renesas Electronics Corporation) DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (Renesas Electronics Corporation) DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atipmdag.sys (ATI Technologies Inc.) DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.) DRV:64bit: - (IntcAzAudAddService) -- C:\Windows\SysNative\drivers\RTKVHD64.sys (Realtek Semiconductor Corp.) DRV:64bit: - (AtiHdmiService) -- C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Technologies, Inc.) DRV:64bit: - (JRAID) -- C:\Windows\SysNative\drivers\jraid.sys (JMicron Technology Corp.) DRV:64bit: - (fvevol) -- C:\Windows\SysNative\drivers\fvevol.sys (Microsoft Corporation) DRV:64bit: - (aksdf) -- C:\Windows\SysNative\drivers\aksdf.sys (Aladdin Knowledge Systems Ltd.) DRV:64bit: - (MTsensor) -- C:\Windows\SysNative\drivers\ASACPI.sys () DRV:64bit: - (CLFS) -- C:\Windows\SysNative\clfs.sys (Microsoft Corporation) DRV:64bit: - (Compbatt) -- C:\Windows\SysNative\drivers\compbatt.sys (Microsoft Corporation) DRV:64bit: - (cmdide) -- C:\Windows\SysNative\drivers\cmdide.sys (CMD Technology, Inc.) DRV:64bit: - (adp94xx) -- C:\Windows\SysNative\drivers\adp94xx.sys (Adaptec, Inc.) DRV:64bit: - (adpahci) -- C:\Windows\SysNative\drivers\adpahci.sys (Adaptec, Inc.) DRV:64bit: - (ACPI) -- C:\Windows\SysNative\drivers\acpi.sys (Microsoft Corporation) DRV:64bit: - (adpu320) -- C:\Windows\SysNative\drivers\adpu320.sys (Adaptec, Inc.) DRV:64bit: - (arcsas) -- C:\Windows\SysNative\drivers\arcsas.sys (Adaptec, Inc.) DRV:64bit: - (arc) -- C:\Windows\SysNative\drivers\arc.sys (Adaptec, Inc.) DRV:64bit: - (agp440) -- C:\Windows\SysNative\drivers\AGP440.sys (Microsoft Corporation) DRV:64bit: - (atapi) -- C:\Windows\SysNative\drivers\atapi.sys (Microsoft Corporation) DRV:64bit: - (amdide) -- C:\Windows\SysNative\drivers\amdide.sys (Microsoft Corporation) DRV:64bit: - (aliide) -- C:\Windows\SysNative\drivers\aliide.sys (Acer Laboratories Inc.) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (NDIS) -- C:\Windows\SysNative\drivers\ndis.sys (Microsoft Corporation) DRV:64bit: - (iScsiPrt) -- C:\Windows\SysNative\drivers\msiscsi.sys (Microsoft Corporation) DRV:64bit: - (mpio) -- C:\Windows\SysNative\drivers\mpio.sys (Microsoft Corporation) DRV:64bit: - (msdsm) -- C:\Windows\SysNative\drivers\msdsm.sys (Microsoft Corporation) DRV:64bit: - (mountmgr) -- C:\Windows\SysNative\drivers\mountmgr.sys (Microsoft Corporation) DRV:64bit: - (Mup) -- C:\Windows\SysNative\drivers\mup.sys (Microsoft Corporation) DRV:64bit: - (mouclass) -- C:\Windows\SysNative\drivers\mouclass.sys (Microsoft Corporation) DRV:64bit: - (mssmbios) -- C:\Windows\SysNative\drivers\mssmbios.sys (Microsoft Corporation) DRV:64bit: - (msahci) -- C:\Windows\SysNative\drivers\msahci.sys (Microsoft Corporation) DRV:64bit: - (msisadrv) -- C:\Windows\SysNative\drivers\msisadrv.sys (Microsoft Corporation) DRV:64bit: - (MsRPC) -- C:\Windows\SysNative\drivers\msrpc.sys (Microsoft Corporation) DRV:64bit: - (nv_agp) -- C:\Windows\SysNative\drivers\NV_AGP.SYS (Microsoft Corporation) DRV:64bit: - (nfrd960) -- C:\Windows\SysNative\drivers\nfrd960.sys (IBM Corporation) DRV:64bit: - (MegaSR) -- C:\Windows\SysNative\drivers\MegaSR.sys (LSI Corporation, Inc.) DRV:64bit: - (LSI_SCSI) -- C:\Windows\SysNative\drivers\lsi_scsi.sys (LSI Corporation) DRV:64bit: - (LSI_FC) -- C:\Windows\SysNative\drivers\lsi_fc.sys (LSI Corporation) DRV:64bit: - (LSI_SAS) -- C:\Windows\SysNative\drivers\lsi_sas.sys (LSI Corporation) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (kbdclass) -- C:\Windows\SysNative\drivers\kbdclass.sys (Microsoft Corporation) DRV:64bit: - (iirsp) -- C:\Windows\SysNative\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH) DRV:64bit: - (megasas) -- C:\Windows\SysNative\drivers\megasas.sys (LSI Corporation) DRV:64bit: - (isapnp) -- C:\Windows\SysNative\drivers\isapnp.sys (Microsoft Corporation) DRV:64bit: - (intelide) -- C:\Windows\SysNative\drivers\intelide.sys (Microsoft Corporation) DRV:64bit: - (hwpolicy) -- C:\Windows\SysNative\drivers\hwpolicy.sys (Microsoft Corporation) DRV:64bit: - (FsDepends) -- C:\Windows\SysNative\drivers\fsdepends.sys (Microsoft Corporation) DRV:64bit: - (elxstor) -- C:\Windows\SysNative\drivers\elxstor.sys (Emulex) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (Disk) -- C:\Windows\SysNative\drivers\disk.sys (Microsoft Corporation) DRV:64bit: - (FileInfo) -- C:\Windows\SysNative\drivers\fileinfo.sys (Microsoft Corporation) DRV:64bit: - (gagp30kx) -- C:\Windows\SysNative\drivers\GAGP30KX.SYS (Microsoft Corporation) DRV:64bit: - (crcdisk) -- C:\Windows\SysNative\drivers\crcdisk.sys (Microsoft Corporation) DRV:64bit: - (FltMgr) -- C:\Windows\SysNative\drivers\fltMgr.sys (Microsoft Corporation) DRV:64bit: - (WIMMount) -- C:\Windows\SysNative\drivers\wimmount.sys (Microsoft Corporation) DRV:64bit: - (Wdf01000) -- C:\Windows\SysNative\drivers\Wdf01000.sys (Microsoft Corporation) DRV:64bit: - (volmgrx) -- C:\Windows\SysNative\drivers\volmgrx.sys (Microsoft Corporation) DRV:64bit: - (volsnap) -- C:\Windows\SysNative\drivers\volsnap.sys (Microsoft Corporation) DRV:64bit: - (vhdmp) -- C:\Windows\SysNative\drivers\vhdmp.sys (Microsoft Corporation) DRV:64bit: - (vmbus) -- C:\Windows\SysNative\drivers\vmbus.sys (Microsoft Corporation) DRV:64bit: - (vsmraid) -- C:\Windows\SysNative\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd) DRV:64bit: - (volmgr) -- C:\Windows\SysNative\drivers\volmgr.sys (Microsoft Corporation) DRV:64bit: - (uliagpkx) -- C:\Windows\SysNative\drivers\ULIAGPKX.SYS (Microsoft Corporation) DRV:64bit: - (uagp35) -- C:\Windows\SysNative\drivers\UAGP35.SYS (Microsoft Corporation) DRV:64bit: - (TermDD) -- C:\Windows\SysNative\drivers\termdd.sys (Microsoft Corporation) DRV:64bit: - (storflt) -- C:\Windows\SysNative\drivers\vmstorfl.sys (Microsoft Corporation) DRV:64bit: - (vdrvroot) -- C:\Windows\SysNative\drivers\vdrvroot.sys (Microsoft Corporation) DRV:64bit: - (storvsc) -- C:\Windows\SysNative\drivers\storvsc.sys (Microsoft Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (Wd) -- C:\Windows\SysNative\drivers\wd.sys (Microsoft Corporation) DRV:64bit: - (spldr) -- C:\Windows\SysNative\drivers\spldr.sys (Microsoft Corporation) DRV:64bit: - (viaide) -- C:\Windows\SysNative\drivers\viaide.sys (VIA Technologies, Inc.) DRV:64bit: - (swenum) -- C:\Windows\SysNative\drivers\swenum.sys (Microsoft Corporation) DRV:64bit: - (ql2300) -- C:\Windows\SysNative\drivers\ql2300.sys (QLogic Corporation) DRV:64bit: - (rdyboost) -- C:\Windows\SysNative\drivers\rdyboost.sys (Microsoft Corporation) DRV:64bit: - (SiSRaid4) -- C:\Windows\SysNative\drivers\sisraid4.sys (Silicon Integrated Systems) DRV:64bit: - (pcmcia) -- C:\Windows\SysNative\drivers\pcmcia.sys (Microsoft Corporation) DRV:64bit: - (pci) -- C:\Windows\SysNative\drivers\pci.sys (Microsoft Corporation) DRV:64bit: - (ql40xx) -- C:\Windows\SysNative\drivers\ql40xx.sys (QLogic Corporation) DRV:64bit: - (sbp2port) -- C:\Windows\SysNative\drivers\sbp2port.sys (Microsoft Corporation) DRV:64bit: - (pcw) -- C:\Windows\SysNative\drivers\pcw.sys (Microsoft Corporation) DRV:64bit: - (SiSRaid2) -- C:\Windows\SysNative\drivers\sisraid2.sys (Silicon Integrated Systems Corp.) DRV:64bit: - (pciide) -- C:\Windows\SysNative\drivers\pciide.sys (Microsoft Corporation) DRV:64bit: - (Brserid) -- C:\Windows\SysNative\drivers\BrSerId.sys (Brother Industries Ltd.) DRV:64bit: - (PEAUTH) -- C:\Windows\SysNative\drivers\PEAuth.sys (Microsoft Corporation) DRV:64bit: - (usbprint) -- C:\Windows\SysNative\drivers\usbprint.sys (Microsoft Corporation) DRV:64bit: - (usbscan) -- C:\Windows\SysNative\drivers\usbscan.sys (Microsoft Corporation) DRV:64bit: - (RDPDR) -- C:\Windows\SysNative\drivers\rdpdr.sys (Microsoft Corporation) DRV:64bit: - (rdpbus) -- C:\Windows\SysNative\drivers\rdpbus.sys (Microsoft Corporation) DRV:64bit: - (tssecsrv) -- C:\Windows\SysNative\drivers\tssecsrv.sys (Microsoft Corporation) DRV:64bit: - (RDPREFMP) -- C:\Windows\SysNative\drivers\RDPREFMP.sys (Microsoft Corporation) DRV:64bit: - (RDPENCDD) -- C:\Windows\SysNative\drivers\RDPENCDD.sys (Microsoft Corporation) DRV:64bit: - (RDPCDD) -- C:\Windows\SysNative\drivers\RDPCDD.sys (Microsoft Corporation) DRV:64bit: - (TDPIPE) -- C:\Windows\SysNative\drivers\tdpipe.sys (Microsoft Corporation) DRV:64bit: - (Modem) -- C:\Windows\SysNative\drivers\modem.sys (Microsoft Corporation) DRV:64bit: - (ws2ifsl) -- C:\Windows\SysNative\drivers\ws2ifsl.sys (Microsoft Corporation) DRV:64bit: - (RasSstp) -- C:\Windows\SysNative\drivers\rassstp.sys (Microsoft Corporation) DRV:64bit: - (RasAgileVpn) -- C:\Windows\SysNative\drivers\agilevpn.sys (Microsoft Corporation) DRV:64bit: - (Wanarpv6) -- C:\Windows\SysNative\drivers\wanarp.sys (Microsoft Corporation) DRV:64bit: - (WANARP) -- C:\Windows\SysNative\drivers\wanarp.sys (Microsoft Corporation) DRV:64bit: - (PptpMiniport) -- C:\Windows\SysNative\drivers\raspptp.sys (Microsoft Corporation) DRV:64bit: - (RasPppoe) -- C:\Windows\SysNative\drivers\raspppoe.sys (Microsoft Corporation) DRV:64bit: - (NdisWan) -- C:\Windows\SysNative\drivers\ndiswan.sys (Microsoft Corporation) DRV:64bit: - (AsyncMac) -- C:\Windows\SysNative\drivers\asyncmac.sys (Microsoft Corporation) DRV:64bit: - (Rasl2tp) -- C:\Windows\SysNative\drivers\rasl2tp.sys (Microsoft Corporation) DRV:64bit: - (RasAcd) -- C:\Windows\SysNative\drivers\rasacd.sys (Microsoft Corporation) DRV:64bit: - (NDProxy) -- C:\Windows\SysNative\drivers\ndproxy.sys (Microsoft Corporation) DRV:64bit: - (IpFilterDriver) -- C:\Windows\SysNative\drivers\ipfltdrv.sys (Microsoft Corporation) DRV:64bit: - (IPNAT) -- C:\Windows\SysNative\drivers\ipnat.sys (Microsoft Corporation) DRV:64bit: - (NdisTapi) -- C:\Windows\SysNative\drivers\ndistapi.sys (Microsoft Corporation) DRV:64bit: - (tcpipreg) -- C:\Windows\SysNative\drivers\tcpipreg.sys (Microsoft Corporation) DRV:64bit: - (QWAVEdrv) -- C:\Windows\SysNative\drivers\qwavedrv.sys (Microsoft Corporation) DRV:64bit: - (Psched) -- C:\Windows\SysNative\drivers\pacer.sys (Microsoft Corporation) DRV:64bit: - (tunnel) -- C:\Windows\SysNative\drivers\tunnel.sys (Microsoft Corporation) DRV:64bit: - (NetBIOS) -- C:\Windows\SysNative\drivers\netbios.sys (Microsoft Corporation) DRV:64bit: - (WfpLwf) -- C:\Windows\SysNative\drivers\wfplwf.sys (Microsoft Corporation) DRV:64bit: - (Ndisuio) -- C:\Windows\SysNative\drivers\ndisuio.sys (Microsoft Corporation) DRV:64bit: - (Smb) -- C:\Windows\SysNative\drivers\smb.sys (Microsoft Corporation) DRV:64bit: - (IRENUM) -- C:\Windows\SysNative\drivers\irenum.sys (Microsoft Corporation) DRV:64bit: - (rspndr) -- C:\Windows\SysNative\drivers\rspndr.sys (Microsoft Corporation) DRV:64bit: - (lltdio) -- C:\Windows\SysNative\drivers\lltdio.sys (Microsoft Corporation) DRV:64bit: - (mpsdrv) -- C:\Windows\SysNative\drivers\mpsdrv.sys (Microsoft Corporation) DRV:64bit: - (NdisCap) -- C:\Windows\SysNative\drivers\ndiscap.sys (Microsoft Corporation) DRV:64bit: - (NativeWifiP) -- C:\Windows\SysNative\drivers\nwifi.sys (Microsoft Corporation) DRV:64bit: - (vwifibus) -- C:\Windows\SysNative\drivers\vwifibus.sys (Microsoft Corporation) DRV:64bit: - (1394ohci) -- C:\Windows\SysNative\drivers\1394ohci.sys (Microsoft Corporation) DRV:64bit: - (HdAudAddService) -- C:\Windows\SysNative\drivers\HdAudio.sys (Microsoft Corporation) DRV:64bit: - (umbus) -- C:\Windows\SysNative\drivers\umbus.sys (Microsoft Corporation) DRV:64bit: - (HidBth) -- C:\Windows\SysNative\drivers\hidbth.sys (Microsoft Corporation) DRV:64bit: - (BTHMODEM) -- C:\Windows\SysNative\drivers\bthmodem.sys (Microsoft Corporation) DRV:64bit: - (UmPass) -- C:\Windows\SysNative\drivers\umpass.sys (Microsoft Corporation) DRV:64bit: - (ohci1394) -- C:\Windows\SysNative\drivers\ohci1394.sys (Microsoft Corporation) DRV:64bit: - (usbcir) -- C:\Windows\SysNative\drivers\usbcir.sys (Microsoft Corporation) DRV:64bit: - (circlass) -- C:\Windows\SysNative\drivers\circlass.sys (Microsoft Corporation) DRV:64bit: - (usbaudio) -- C:\Windows\SysNative\drivers\USBAUDIO.sys (Microsoft Corporation) DRV:64bit: - (WinUsb) -- C:\Windows\SysNative\drivers\winusb.sys (Microsoft Corporation) DRV:64bit: - (mshidkmdf) -- C:\Windows\SysNative\drivers\mshidkmdf.sys (Microsoft Corporation) DRV:64bit: - (HidIr) -- C:\Windows\SysNative\drivers\hidir.sys (Microsoft Corporation) DRV:64bit: - (HidUsb) -- C:\Windows\SysNative\drivers\hidusb.sys (Microsoft Corporation) DRV:64bit: - (drmkaud) -- C:\Windows\SysNative\drivers\drmkaud.sys (Microsoft Corporation) DRV:64bit: - (HDAudBus) -- C:\Windows\SysNative\drivers\hdaudbus.sys (Microsoft Corporation) DRV:64bit: - (WUDFRd) -- C:\Windows\SysNative\drivers\WUDFRd.sys (Microsoft Corporation) DRV:64bit: - (WudfPf) -- C:\Windows\SysNative\drivers\WUDFPf.sys (Microsoft Corporation) DRV:64bit: - (MTConfig) -- C:\Windows\SysNative\drivers\MTConfig.sys (Microsoft Corporation) DRV:64bit: - (WacomPen) -- C:\Windows\SysNative\drivers\wacompen.sys (Microsoft Corporation) DRV:64bit: - (sffp_mmc) -- C:\Windows\SysNative\drivers\sffp_mmc.sys (Microsoft Corporation) DRV:64bit: - (sfloppy) -- C:\Windows\SysNative\drivers\sfloppy.sys (Microsoft Corporation) DRV:64bit: - (sffp_sd) -- C:\Windows\SysNative\drivers\sffp_sd.sys (Microsoft Corporation) DRV:64bit: - (sffdisk) -- C:\Windows\SysNative\drivers\sffdisk.sys (Microsoft Corporation) DRV:64bit: - (fdc) -- C:\Windows\SysNative\drivers\fdc.sys (Microsoft Corporation) DRV:64bit: - (flpydisk) -- C:\Windows\SysNative\drivers\flpydisk.sys (Microsoft Corporation) DRV:64bit: - (Parport) -- C:\Windows\SysNative\drivers\parport.sys (Microsoft Corporation) DRV:64bit: - (Serial) -- C:\Windows\SysNative\drivers\serial.sys (Microsoft Corporation) DRV:64bit: - (CompositeBus) -- C:\Windows\SysNative\drivers\CompositeBus.sys (Microsoft Corporation) DRV:64bit: - (Serenum) -- C:\Windows\SysNative\drivers\serenum.sys (Microsoft Corporation) DRV:64bit: - (kbdhid) -- C:\Windows\SysNative\drivers\kbdhid.sys (Microsoft Corporation) DRV:64bit: - (mouhid) -- C:\Windows\SysNative\drivers\mouhid.sys (Microsoft Corporation) DRV:64bit: - (sermouse) -- C:\Windows\SysNative\drivers\sermouse.sys (Microsoft Corporation) DRV:64bit: - (ksthunk) -- C:\Windows\SysNative\drivers\ksthunk.sys (Microsoft Corporation) DRV:64bit: - (MSKSSRV) -- C:\Windows\SysNative\drivers\mskssrv.sys (Microsoft Corporation) DRV:64bit: - (MSTEE) -- C:\Windows\SysNative\drivers\mstee.sys (Microsoft Corporation) DRV:64bit: - (MSPCLOCK) -- C:\Windows\SysNative\drivers\mspclock.sys (Microsoft Corporation) DRV:64bit: - (MSPQM) -- C:\Windows\SysNative\drivers\mspqm.sys (Microsoft Corporation) DRV:64bit: - (Beep) -- C:\Windows\SysNative\drivers\beep.sys (Microsoft Corporation) DRV:64bit: - (AppID) -- C:\Windows\SysNative\drivers\appid.sys (Microsoft Corporation) DRV:64bit: - (scfilter) -- C:\Windows\SysNative\drivers\scfilter.sys (Microsoft Corporation) DRV:64bit: - (IPMIDRV) -- C:\Windows\SysNative\drivers\IPMIDrv.sys (Microsoft Corporation) DRV:64bit: - (s3cap) -- C:\Windows\SysNative\drivers\vms3cap.sys (Microsoft Corporation) DRV:64bit: - (VMBusHID) -- C:\Windows\SysNative\drivers\VMBusHID.sys (Microsoft Corporation) DRV:64bit: - (monitor) -- C:\Windows\SysNative\drivers\monitor.sys (Microsoft Corporation) DRV:64bit: - (VgaSave) -- C:\Windows\SysNative\drivers\vga.sys (Microsoft Corporation) DRV:64bit: - (vga) -- C:\Windows\SysNative\drivers\vgapnp.sys (Microsoft Corporation) DRV:64bit: - (discache) -- C:\Windows\SysNative\drivers\discache.sys (Microsoft Corporation) DRV:64bit: - (blbdrive) -- C:\Windows\SysNative\drivers\blbdrive.sys (Microsoft Corporation) DRV:64bit: - (HidBatt) -- C:\Windows\SysNative\drivers\hidbatt.sys (Microsoft Corporation) DRV:64bit: - (ErrDev) -- C:\Windows\SysNative\drivers\errdev.sys (Microsoft Corporation) DRV:64bit: - (CmBatt) -- C:\Windows\SysNative\drivers\CmBatt.sys (Microsoft Corporation) DRV:64bit: - (WmiAcpi) -- C:\Windows\SysNative\drivers\wmiacpi.sys (Microsoft Corporation) DRV:64bit: - (AcpiPmi) -- C:\Windows\SysNative\drivers\acpipmi.sys (Microsoft Corporation) DRV:64bit: - (luafv) -- C:\Windows\SysNative\drivers\luafv.sys (Microsoft Corporation) DRV:64bit: - (Filetrace) -- C:\Windows\SysNative\drivers\filetrace.sys (Microsoft Corporation) DRV:64bit: - (CSC) -- C:\Windows\SysNative\drivers\csc.sys (Microsoft Corporation) DRV:64bit: - (rdbss) -- C:\Windows\SysNative\drivers\rdbss.sys (Microsoft Corporation) DRV:64bit: - (MRxDAV) -- C:\Windows\SysNative\drivers\mrxdav.sys (Microsoft Corporation) DRV:64bit: - (udfs) -- C:\Windows\SysNative\drivers\udfs.sys (Microsoft Corporation) DRV:64bit: - (fastfat) -- C:\Windows\SysNative\drivers\fastfat.sys (Microsoft Corporation) DRV:64bit: - (exfat) -- C:\Windows\SysNative\drivers\exfat.sys (Microsoft Corporation) DRV:64bit: - (HTTP) -- C:\Windows\SysNative\drivers\http.sys (Microsoft Corporation) DRV:64bit: - (NetBT) -- C:\Windows\SysNative\drivers\netbt.sys (Microsoft Corporation) DRV:64bit: - (tdx) -- C:\Windows\SysNative\drivers\tdx.sys (Microsoft Corporation) DRV:64bit: - (nsiproxy) -- C:\Windows\SysNative\drivers\nsiproxy.sys (Microsoft Corporation) DRV:64bit: - (i8042prt) -- C:\Windows\SysNative\drivers\i8042prt.sys (Microsoft Corporation) DRV:64bit: - (cdrom) -- C:\Windows\SysNative\drivers\cdrom.sys (Microsoft Corporation) DRV:64bit: - (Npfs) -- C:\Windows\SysNative\drivers\npfs.sys (Microsoft Corporation) DRV:64bit: - (cdfs) -- C:\Windows\SysNative\drivers\cdfs.sys (Microsoft Corporation) DRV:64bit: - (Msfs) -- C:\Windows\SysNative\drivers\msfs.sys (Microsoft Corporation) DRV:64bit: - (Null) -- C:\Windows\SysNative\drivers\null.sys (Microsoft Corporation) DRV:64bit: - (AmdK8) -- C:\Windows\SysNative\drivers\amdk8.sys (Microsoft Corporation) DRV:64bit: - (intelppm) -- C:\Windows\SysNative\drivers\intelppm.sys (Microsoft Corporation) DRV:64bit: - (AmdPPM) -- C:\Windows\SysNative\drivers\amdppm.sys (Microsoft Corporation) DRV:64bit: - (Processor) -- C:\Windows\SysNative\drivers\processr.sys (Microsoft Corporation) DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.) DRV:64bit: - (BrSerWdm) -- C:\Windows\SysNative\drivers\BrSerWdm.sys (Brother Industries Ltd.) DRV:64bit: - (BrUsbMdm) -- C:\Windows\SysNative\drivers\BrUsbMdm.sys (Brother Industries Ltd.) DRV:64bit: - (BrUsbSer) -- C:\Windows\SysNative\drivers\BrUsbSer.sys (Brother Industries Ltd.) DRV:64bit: - (BrFiltLo) -- C:\Windows\SysNative\drivers\BrFiltLo.sys (Brother Industries, Ltd.) DRV:64bit: - (BrFiltUp) -- C:\Windows\SysNative\drivers\BrFiltUp.sys (Brother Industries, Ltd.) DRV:64bit: - (secdrv) -- C:\Windows\SysNative\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.) DRV:64bit: - (AtiPcie) -- C:\Windows\SysNative\drivers\AtiPcie.sys (Advanced Micro Devices Inc.) DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.) DRV:64bit: - (hardlock) -- C:\Windows\SysNative\drivers\hardlock.sys (Aladdin Knowledge Systems Ltd.) DRV:64bit: - (aksfridge) -- C:\Windows\SysNative\drivers\aksfridge.sys (Aladdin Knowledge Systems Ltd.) DRV:64bit: - (SNPSTD3) -- C:\Windows\SysNative\drivers\snpstd3.sys (Sonix Co. Ltd.) DRV - (NAVEX15) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\VirusDefs\20120911.002\ex64.sys (Symantec Corporation) DRV - (NAVENG) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\VirusDefs\20120911.002\eng64.sys (Symantec Corporation) DRV - (IDSVia64) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\IPSDefs\20120908.001\IDSviA64.sys (Symantec Corporation) DRV - (BHDrvx64) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\BASHDefs\20120905.001\BHDrvx64.sys (Symantec Corporation) DRV - (eeCtrl) -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation) DRV - (EraserUtilRebootDrv) -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) DRV - (SNPSTD3) -- C:\Windows\SysWOW64\drivers\snpstd3.sys (Sonix Co. Ltd.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\URLSearchHook: {ff88a983-649d-4207-9336-9b999280b436} - C:\Program Files (x86)\SFT_de3\prxtbSFT_.dll (Conduit Ltd.) IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3031778 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 1E 10 DD AC 0F 82 CD 01 [binary data] IE - HKCU\..\URLSearchHook: {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll (DeviceVM, Inc.) IE - HKCU\..\URLSearchHook: {ff88a983-649d-4207-9336-9b999280b436} - C:\Program Files (x86)\SFT_de3\prxtbSFT_.dll (Conduit Ltd.) IE - HKCU\..\SearchScopes,DefaultScope = {219A0209-EFB1-450d-B86E-CC8F5A369719} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{219A0209-EFB1-450d-B86E-CC8F5A369719}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=EGMB IE - HKCU\..\SearchScopes\{5F70BF71-5042-4d6e-98D2-E6908CD6CCA4}: "URL" = hxxp://www.google.com/custom?client=pub-3794288947762788&forid=1&channel=5369970905&ie=UTF-8&oe=UTF-8&safe=active&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A1&hl=de&q={searchTerms} IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3031778 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Search the web" FF - prefs.js..browser.search.order.1: "Search the web" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.startup.homepage: "google.de" FF - prefs.js..extensions.enabledAddons: software@loadtubes.com:1.01 FF - prefs.js..extensions.enabledAddons: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.2.145 FF - prefs.js..keyword.URL: "hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q=" FF - user.js..browser.search.selectedEngine: "Search the web" FF - user.js..browser.search.order.1: "Search the web" FF - user.js..browser.search.defaultenginename: "Search the web" FF - user.js..keyword.URL: "hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q=" FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_271.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_271.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.116.0: C:\Program Files (x86)\Battlelog Web Plugins\1.116.0\npesnlaunch.dll File not found FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.122.0: C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\IPSFFPlgn\ [2012.03.13 21:24:18 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\coFFPlgn\ [2012.09.13 15:08:18 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.02.16 01:46:49 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.09.07 22:24:08 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.09.07 22:24:06 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.09.07 22:24:08 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.09.07 22:24:06 | 000,000,000 | ---D | M] [2011.12.21 00:15:06 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Diseck\AppData\Roaming\mozilla\Extensions [2012.08.21 17:48:29 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Diseck\AppData\Roaming\mozilla\Firefox\Profiles\sg49yi49.default\extensions [2012.08.21 17:48:29 | 000,000,000 | -H-D | M] (SFT_de3 Community Toolbar) -- C:\Users\Diseck\AppData\Roaming\mozilla\Firefox\Profiles\sg49yi49.default\extensions\{ff88a983-649d-4207-9336-9b999280b436} [2012.04.10 23:54:57 | 000,000,000 | -H-D | M] (loadtbs) -- C:\Users\Diseck\AppData\Roaming\mozilla\Firefox\Profiles\sg49yi49.default\extensions\software@loadtubes.com [2012.02.04 02:22:38 | 000,000,000 | -H-D | M] (Ask Toolbar) -- C:\Users\Diseck\AppData\Roaming\mozilla\Firefox\Profiles\sg49yi49.default\extensions\toolbar@ask.com [2012.02.15 22:55:08 | 000,000,000 | -H-D | M] (toolplugin) -- C:\Users\Diseck\AppData\Roaming\mozilla\Firefox\Profiles\sg49yi49.default\extensions\welcome@toolmin.com [2012.09.07 22:24:06 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012.09.07 22:24:06 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012.02.16 01:46:49 | 000,000,000 | ---D | M] (DivX Plus Web Player HTML5 <video>) -- C:\PROGRAM FILES (X86)\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5 [2012.09.07 22:24:08 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2012.02.15 16:48:02 | 000,378,880 | ---- | M] (InfiniAd GmbH) -- C:\Program Files (x86)\mozilla firefox\plugins\npmieze.dll [2012.09.02 16:05:13 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012.02.15 22:55:08 | 000,000,158 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\Search the web.src [2012.09.02 16:05:13 | 000,002,253 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngin.dll (Conduit Ltd.) O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\19.8.0.14\coIEPlg.dll (Symantec Corporation) O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\19.8.0.14\IPS\IPSBHO.DLL (Symantec Corporation) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask.com) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (SFT_de3 Toolbar) - {ff88a983-649d-4207-9336-9b999280b436} - C:\Program Files (x86)\SFT_de3\prxtbSFT_.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngin.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\19.8.0.14\coIEPlg.dll (Symantec Corporation) O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask.com) O3 - HKLM\..\Toolbar: (loadtbs) - {DFEFCDEE-CF1A-4FC8-88AD-129872198372} - C:\Users\Diseck\AppData\Roaming\loadtbs\toolbar.dll (InfiniAd GmbH) O3 - HKLM\..\Toolbar: (toolplugin) - {DFEFCDEE-CF1A-4FC8-89AF-189327213627} - C:\Users\Diseck\AppData\Roaming\toolplugin\toolbar.dll () O3 - HKLM\..\Toolbar: (SFT_de3 Toolbar) - {ff88a983-649d-4207-9336-9b999280b436} - C:\Program Files (x86)\SFT_de3\prxtbSFT_.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\19.8.0.14\coIEPlg.dll (Symantec Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask.com) O3 - HKCU\..\Toolbar\WebBrowser: (SFT_de3 Toolbar) - {FF88A983-649D-4207-9336-9B999280B436} - C:\Program Files (x86)\SFT_de3\prxtbSFT_.dll (Conduit Ltd.) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4:64bit: - HKLM..\Run: [snpstd3] C:\Windows\vsnpstd3.exe () O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [BCU] C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe (DeviceVM, Inc.) O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () O4 - HKLM..\Run: [EEventManager] C:\PROGRA~2\EPSONS~1\EVENTM~1\EEventManager.exe (SEIKO EPSON CORPORATION) O4 - HKLM..\Run: [FixCamera] C:\Windows\FixCamera.exe () O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe () O4 - HKLM..\Run: [LogMeIn Hamachi Ui] "E:\Games\hamachi-2-ui.exe" --auto-start File not found O4 - HKLM..\Run: [NBAgent] C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe (Nero AG) O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation) O4 - HKLM..\Run: [QFan Help] C:\Program Files (x86)\ASUS\AI Suite\QFan4\FanHelp.exe (ASUSTeK Computer Inc.) O4 - HKLM..\Run: [Six Engine] C:\Program Files (x86)\ASUS\EPU\EPU.exe ( ASUSTeK Computer Inc.) O4 - HKLM..\Run: [snpstd3] C:\Windows\vsnpstd3.exe () O4 - HKLM..\Run: [tsnpstd3] C:\Windows\tsnpstd3.exe () O4 - HKLM..\Run: [TurboV EVO] C:\Program Files\ASUS\TurboV EVO\TurboV_EVO.exe (ASUSTeK Computer Inc.) O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) O4 - HKCU..\Run: [EPSON SX210 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIFDE.EXE /FU "C:\Windows\TEMP\E_S9E84.tmp" /EF "HKCU" File not found O4 - HKCU..\Run: [jipudqbw] "C:\Users\Diseck\AppData\Local\hpidhalm.exe" File not found O4 - HKCU..\Run: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.) O4 - HKCU..\Run: [nbxlbdib] "C:\Users\Diseck\AppData\Local\hpidhalm.exe" File not found O4 - HKCU..\Run: [QqKfUnJuwERq.exe] C:\ProgramData\QqKfUnJuwERq.exe (CQP) O4 - HKCU..\Run: [xawnaakp] "C:\Users\Diseck\AppData\Local\awphddcn.exe" File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 0 O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{01645BFC-4730-4BF4-A457-2D40CE30E6ED}: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation) O20 - HKCU Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.07.14 11:29:38 | 000,000,122 | R--- | M] () - F:\autorun.inf -- [ UDF ] O33 - MountPoints2\{111c5bcd-2b1b-11e1-a82d-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{111c5bcd-2b1b-11e1-a82d-806e6f6e6963}\Shell\AutoRun\command - "" = F:\Autorun.exe O33 - MountPoints2\{4e36f707-2b12-11e1-b7c2-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{4e36f707-2b12-11e1-b7c2-806e6f6e6963}\Shell\AutoRun\command - "" = F:\.\Bin\ASSETUP.exe O33 - MountPoints2\{b3a47061-5d5f-11e1-ba86-20cf305acc61}\Shell - "" = AutoRun O33 - MountPoints2\{b3a47061-5d5f-11e1-ba86-20cf305acc61}\Shell\AutoRun\command - "" = G:\Autorun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.09.13 15:08:50 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{C7CF6F77-E251-4070-A84F-C982A3BA47A4} [2012.09.13 14:20:28 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{91327B91-9B20-42C7-84AD-84D108049D1D} [2012.09.13 14:15:50 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{900D30A8-0B60-40CC-92B9-B7FBA6635DD1} [2012.09.13 13:28:00 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{3A94DC83-7B60-4F66-9FBE-D5F29B2C9DD6} [2012.09.12 23:31:31 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Roaming\Malwarebytes [2012.09.12 23:31:27 | 000,000,000 | -H-D | C] -- C:\ProgramData\Malwarebytes [2012.09.12 23:31:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.09.12 23:31:26 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.09.12 23:31:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2012.09.12 23:23:00 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{0A806097-9621-46EA-ADEF-BC0858546C8B} [2012.09.11 23:13:01 | 000,278,016 | -H-- | C] (CQP) -- C:\ProgramData\lN4g81Fi3fHQ6c.exe [2012.09.11 22:59:57 | 000,380,416 | -H-- | C] (CQP) -- C:\ProgramData\QqKfUnJuwERq.exe [2012.09.11 22:57:57 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{CA561361-D402-4A77-AC55-7C6A6EC45804} [2012.09.10 21:16:49 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{7614E840-B385-46AD-B0DF-1B78848CF1F4} [2012.09.10 08:51:47 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{1CFA2A96-3251-4F48-95D2-3E5E6AD9B8F2} [2012.09.09 16:24:34 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{3980F12C-656A-43EE-95D1-E986A74F4FA6} [2012.09.07 22:24:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2012.09.07 20:45:38 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{949EAA69-DBD8-4F56-830B-813638BE75EE} [2012.09.07 07:53:17 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{971F6D43-3BF1-46DB-9B89-6428E772A529} [2012.09.06 16:01:27 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{5C990785-DB68-458A-8BF9-86B2B4D6D258} [2012.09.05 23:19:15 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{4D854A1B-48A5-42B0-9428-217309A57C96} [2012.09.04 21:09:36 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{E256DF5F-0D7C-4ABB-AF6B-F6AC5ABA5D5C} [2012.09.04 08:54:30 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{D13C1875-A210-4D7E-A989-AA6506699BE0} [2012.09.03 20:31:29 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{9F2A058F-9036-4230-B662-960437218C42} [2012.09.03 08:27:29 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{8BD0E2D1-87B2-44C5-8098-EA41C8408C4E} [2012.09.02 16:04:02 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{CAE9492B-2A45-4DD0-ACE9-306ABF740DC4} [2012.09.02 02:22:52 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{8868E99D-5C9E-449A-B148-B80C652058D5} [2012.09.01 14:22:25 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{D6785F46-81D4-437E-94DA-3188DF57FD83} [2012.08.31 15:04:41 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{CB0EFF37-2309-4620-BECA-E5FAD45BB8AC} [2012.08.30 17:15:26 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\appmgmt [2012.08.30 16:53:29 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{CC85F00B-8114-42F2-BBE5-34BF278A3DD2} [2012.08.30 16:53:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi [2012.08.30 03:32:02 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{4908FCCC-5A3B-45DE-ABFB-18ECA479C24E} [2012.08.30 03:11:32 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{8A04626F-DF3D-450F-9A6B-57A0556ECF7C} [2012.08.27 21:42:20 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{9BAFE2D7-131F-4C30-A689-5C3A0871AAA0} [2012.08.27 17:19:51 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{46E80FC6-B892-46FC-A4BC-7CDC99E3C30E} [2012.08.27 00:25:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VID_0E8F&PID_0003 [2012.08.27 00:11:58 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{EE8731D8-0435-4914-B4C3-0E1F9077F7DD} [2012.08.26 15:21:04 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\Documents\Eden Games [2012.08.26 15:18:58 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\CrashRpt [2012.08.26 01:16:31 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{7AF1357A-844C-46EB-80E4-C6047089D43A} [2012.08.24 23:54:42 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{ED67B027-5092-4640-AC0B-14328A19ACF0} [2012.08.24 19:25:56 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\Macromedia [2012.08.24 18:03:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Atari [2012.08.24 17:50:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service [2012.08.24 17:48:34 | 000,426,184 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2012.08.24 07:49:49 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{408A675C-154A-41BC-890B-12766DC666DB} [2012.08.23 12:19:51 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{67AEAA0E-E09A-46F7-941D-9EBBC2A81ED2} [2012.08.21 21:35:27 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{4063671E-2AA3-49B7-A238-0151D2D98A6D} [2012.08.21 02:50:07 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{0C20C1A8-4519-4342-BC12-9D6B66E26DD7} [2012.08.20 14:25:44 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{A31AD4E3-6882-42F9-BAA4-9325A23DD773} [2012.08.19 21:39:41 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{7166C226-A3D4-4844-AD77-A22FCADA3AEF} [2012.08.19 10:20:20 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{C5B456E7-FEA8-478B-AD08-C64F5199138E} [2012.08.18 12:47:26 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{A026FCD6-C9A2-44E4-BADD-A0AA34606160} [2012.08.18 12:47:14 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{3649FC59-F432-4869-B6CD-1E8DC5ABCBC3} [2012.08.17 19:54:25 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{65636FF2-ADEF-4067-9F34-7F547EE2F73C} [2012.08.17 19:54:15 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{1A02F06E-3603-44D0-8FA3-E3DD2053F9BE} [2012.08.17 01:47:38 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{598AFDB9-82C2-4007-AB88-8682A8674CE5} [2012.08.17 01:47:27 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{F7917EA7-3A85-4588-8DF4-2F5DF9B26A57} [2012.08.16 07:25:56 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{26BA177C-65D6-4985-895C-2A2609926438} [2012.08.16 07:25:45 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{1A1A5698-9B6B-4D3C-834B-338CFD1040AA} [2012.08.15 03:00:47 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2012.08.15 03:00:47 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2012.08.15 03:00:47 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2012.08.15 03:00:47 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2012.08.15 03:00:46 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2012.08.15 03:00:46 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2012.08.15 03:00:46 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2012.08.15 03:00:46 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe [2012.08.15 03:00:46 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2012.08.15 03:00:45 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2012.08.15 03:00:45 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2012.08.15 03:00:45 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2012.08.15 03:00:44 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2012.08.15 02:57:21 | 000,503,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\srcore.dll [2012.08.15 02:57:19 | 000,751,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll [2012.08.15 02:57:19 | 000,492,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll [2012.08.15 02:57:19 | 000,067,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\splwow64.exe [2012.08.15 02:57:18 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netapi32.dll [2012.08.15 02:57:18 | 000,058,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\browcli.dll [2012.08.15 02:57:18 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\browcli.dll [2012.08.15 02:57:16 | 000,956,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\localspl.dll [2012.08.15 02:52:04 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{A137E8FD-1760-4D27-9658-8B09C4BB3191} [2012.08.15 02:51:46 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{97060FBA-D952-4DFC-83CC-DFFA1F24CD9B} [2007.08.13 18:46:00 | 000,102,912 | -H-- | C] (Albert L Faber) -- C:\Users\Diseck\AppData\Local\CDRip.dll [2007.01.18 22:09:54 | 000,623,616 | -H-- | C] (Ivan Bischof ©2003 - 2005) -- C:\Users\Diseck\AppData\Local\No23 Recorder.exe [2006.12.11 20:13:14 | 000,013,872 | -H-- | C] (Un4seen Developments) -- C:\Users\Diseck\AppData\Local\basscd.dll [2006.12.11 20:13:12 | 000,097,336 | -H-- | C] (Un4seen Developments) -- C:\Users\Diseck\AppData\Local\bass.dll [1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.09.13 15:07:56 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.09.13 15:07:50 | 3219,791,872 | -HS- | M] () -- C:\hiberfil.sys [2012.09.13 14:35:34 | 000,018,816 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.09.13 14:35:34 | 000,018,816 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.09.13 14:18:05 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.09.12 23:31:33 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.09.12 23:31:33 | 000,654,150 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.09.12 23:31:33 | 000,616,032 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.09.12 23:31:33 | 000,130,022 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.09.12 23:31:33 | 000,106,412 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.09.12 00:13:39 | 000,380,416 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\jfemgpvq.exe [2012.09.11 23:13:19 | 000,000,112 | -H-- | M] () -- C:\ProgramData\lN4g81Fi3fHQ6c [2012.09.11 23:13:01 | 000,278,016 | -H-- | M] (CQP) -- C:\ProgramData\lN4g81Fi3fHQ6c.exe [2012.09.11 22:57:20 | 000,380,416 | -H-- | M] (CQP) -- C:\ProgramData\QqKfUnJuwERq.exe [2012.09.11 22:57:15 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\nvjqxxrf [2012.09.11 07:49:26 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\srqhqhga [2012.09.10 22:49:58 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\gajqewcl [2012.09.10 21:16:23 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\qrmmbeqi [2012.09.10 08:51:44 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\rjudvgwt [2012.09.09 16:24:15 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\ixcgowmx [2012.09.08 13:55:18 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\cfhxhkng [2012.09.07 20:45:22 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\sfqtvwvg [2012.09.07 17:04:46 | 000,025,928 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.09.06 20:52:38 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\ffgvhpfq [2012.09.06 16:01:35 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\wtqhfwnf [2012.09.05 23:19:14 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\nnocvtbl [2012.09.04 21:10:11 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\ldnujfdh [2012.09.03 21:43:50 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\ccjoetux [2012.09.03 20:31:35 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\wdajqqsp [2012.09.02 16:03:56 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\mhokdnuw [2012.09.01 14:22:29 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\usipaceh [2012.08.31 15:23:00 | 000,000,254 | ---- | M] () -- C:\Windows\tasks\Epson Printer Software Downloader.job [2012.08.31 15:04:35 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\sppkauuw [2012.08.31 00:11:25 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\kxlrinlq [2012.08.30 16:57:06 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\gwtdjdnv [2012.08.30 16:52:36 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\gxaifewv [2012.08.30 03:37:11 | 000,283,304 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr [2012.08.30 03:37:11 | 000,283,304 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe [2012.08.29 21:08:58 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\pnusprao [2012.08.29 18:57:54 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\wxrvdbnd [2012.08.29 16:07:04 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\hcvgdtup [2012.08.29 15:46:42 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\jknoxhjh [2012.08.29 05:24:14 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\qmlaqoaw [2012.08.28 13:07:14 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\ecehjngf [2012.08.27 22:52:37 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\wwvhjnup [2012.08.26 18:06:21 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\ledgaeqn [2012.08.26 01:16:07 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\ngahoagv [2012.08.24 18:18:55 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2012.08.24 18:18:55 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2012.08.24 17:50:19 | 000,001,130 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2012.08.24 16:45:36 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\pbomxtej [2012.08.24 07:50:04 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\bkjexcbc [2012.08.23 14:38:08 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\lnqaxxsb [2012.08.21 09:40:47 | 000,059,904 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\bucopatf [2012.08.16 14:00:46 | 000,059,904 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\nxonvsqq [2012.08.16 07:35:45 | 000,008,942 | ---- | M] () -- C:\Windows\SysNative\drivers\NISx64\1308000.00E\VT20120731.038 [2012.08.16 07:24:03 | 002,040,616 | ---- | M] () -- C:\Windows\SysNative\drivers\NISx64\1308000.00E\Cat.DB [2012.08.15 12:15:39 | 000,059,904 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\mdhnomdv [2012.08.15 05:59:11 | 000,267,704 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.09.12 00:13:32 | 000,380,416 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\jfemgpvq.exe [2012.09.11 23:13:19 | 000,000,112 | -H-- | C] () -- C:\ProgramData\lN4g81Fi3fHQ6c [2012.09.11 22:57:15 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\nvjqxxrf [2012.09.11 07:49:26 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\srqhqhga [2012.09.10 22:49:58 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\gajqewcl [2012.09.10 21:16:23 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\qrmmbeqi [2012.09.10 08:51:44 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\rjudvgwt [2012.09.09 16:24:15 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\ixcgowmx [2012.09.08 13:55:18 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\cfhxhkng [2012.09.07 20:45:22 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\sfqtvwvg [2012.09.06 20:52:38 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\ffgvhpfq [2012.09.06 16:01:35 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\wtqhfwnf [2012.09.05 23:19:14 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\nnocvtbl [2012.09.04 21:10:11 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\ldnujfdh [2012.09.03 21:43:50 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\ccjoetux [2012.09.03 20:31:35 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\wdajqqsp [2012.09.02 16:03:56 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\mhokdnuw [2012.09.01 14:22:29 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\usipaceh [2012.08.31 15:04:35 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\sppkauuw [2012.08.31 00:11:25 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\kxlrinlq [2012.08.30 16:57:06 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\gwtdjdnv [2012.08.30 16:52:36 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\gxaifewv [2012.08.29 21:08:58 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\pnusprao [2012.08.29 18:57:54 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\wxrvdbnd [2012.08.29 16:07:04 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\hcvgdtup [2012.08.29 15:46:42 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\jknoxhjh [2012.08.29 05:24:14 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\qmlaqoaw [2012.08.28 13:07:14 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\ecehjngf [2012.08.27 22:52:37 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\wwvhjnup [2012.08.26 18:06:21 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\ledgaeqn [2012.08.26 01:16:07 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\ngahoagv [2012.08.24 17:50:18 | 000,001,130 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2012.08.24 17:50:10 | 000,001,142 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2012.08.24 17:48:40 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.08.24 16:45:36 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\pbomxtej [2012.08.24 07:50:04 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\bkjexcbc [2012.08.23 14:38:08 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\lnqaxxsb [2012.08.21 09:40:47 | 000,059,904 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\bucopatf [2012.08.16 14:00:46 | 000,059,904 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\nxonvsqq [2012.08.15 12:15:39 | 000,059,904 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\mdhnomdv [2012.08.14 08:37:59 | 000,059,904 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\pvrjupvt [2012.08.13 19:50:35 | 000,060,416 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\vikaxulk [2012.08.12 15:57:16 | 000,060,416 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\wbcafdnh [2012.08.11 12:11:17 | 000,059,904 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\iencaxbe [2012.08.10 21:24:31 | 000,060,416 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\dakuxlcc [2012.08.09 23:41:47 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\tsnntubj [2012.08.08 18:15:10 | 000,058,880 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\hljipudq [2012.08.08 18:14:33 | 000,000,000 | -H-- | C] () -- C:\Users\Diseck\AppData\Roaming\SharedSettings.ccs [2012.06.19 01:14:52 | 000,020,480 | ---- | C] () -- C:\Windows\FixCamera.exe [2012.06.19 01:14:39 | 000,835,584 | ---- | C] () -- C:\Windows\vsnpstd3.exe [2012.06.19 01:14:39 | 000,270,336 | ---- | C] () -- C:\Windows\tsnpstd3.exe [2012.06.19 01:14:39 | 000,015,498 | ---- | C] () -- C:\Windows\snpstd3.ini [2012.06.19 01:14:38 | 000,155,648 | ---- | C] ( ) -- C:\Windows\SysWow64\rsnpstd3.dll [2012.06.19 01:14:38 | 000,057,344 | ---- | C] ( ) -- C:\Windows\SysWow64\vsnpstd3.dll [2012.06.19 01:14:38 | 000,053,248 | ---- | C] ( ) -- C:\Windows\csnpstd3.dll [2012.03.16 02:20:41 | 000,007,651 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\Resmon.ResmonCfg [2012.02.29 14:26:56 | 000,416,064 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe [2011.12.29 21:43:56 | 000,001,459 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\RecConfig.xml [2011.12.21 16:16:39 | 000,111,932 | ---- | C] () -- C:\Windows\SysWow64\EPPICPrinterDB.dat [2011.12.21 16:16:39 | 000,031,053 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern131.dat [2011.12.21 16:16:39 | 000,027,417 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern121.dat [2011.12.21 16:16:39 | 000,026,154 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern1.dat [2011.12.21 16:16:39 | 000,024,903 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern3.dat [2011.12.21 16:16:39 | 000,021,390 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern5.dat [2011.12.21 16:16:39 | 000,020,148 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern2.dat [2011.12.21 16:16:39 | 000,011,811 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern4.dat [2011.12.21 16:16:39 | 000,004,943 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern6.dat [2011.12.21 16:16:39 | 000,001,146 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_DU.dat [2011.12.21 16:16:39 | 000,001,139 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_PT.dat [2011.12.21 16:16:39 | 000,001,139 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_BP.dat [2011.12.21 16:16:39 | 000,001,136 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_ES.dat [2011.12.21 16:16:39 | 000,001,129 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_FR.dat [2011.12.21 16:16:39 | 000,001,129 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_CF.dat [2011.12.21 16:16:39 | 000,001,120 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_IT.dat [2011.12.21 16:16:39 | 000,001,107 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_GE.dat [2011.12.21 16:16:39 | 000,001,104 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_EN.dat [2011.12.21 16:16:39 | 000,000,097 | ---- | C] () -- C:\Windows\SysWow64\PICSDK.ini [2011.12.21 00:41:30 | 000,283,304 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2011.12.21 00:41:29 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe [2011.12.21 00:41:28 | 002,434,856 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_bc2.exe [2011.12.20 16:58:41 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2011.12.20 16:43:18 | 000,024,576 | R--- | C] () -- C:\Windows\SysWow64\AsIO.dll [2011.12.20 16:43:18 | 000,013,440 | R--- | C] () -- C:\Windows\SysWow64\drivers\AsIO.sys [2011.12.20 16:43:15 | 000,011,832 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp64.sys [2011.12.20 16:43:15 | 000,010,216 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp32.sys [2011.12.20 16:40:55 | 000,001,035 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat [2011.12.20 16:34:36 | 000,048,278 | ---- | C] () -- C:\Windows\Ascd_log.ini [2011.12.20 16:33:25 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini [2011.12.20 16:33:19 | 000,032,976 | ---- | C] () -- C:\Windows\Ascd_tmp.ini [2007.08.13 18:46:00 | 000,155,136 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\lame_enc.dll [2006.10.26 02:06:48 | 000,064,000 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\vorbisenc.dll [2006.10.26 02:06:48 | 000,019,456 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\vorbisfile.dll [2006.10.26 02:06:46 | 000,143,872 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\vorbis.dll [2006.10.26 02:06:36 | 000,015,872 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\ogg.dll [2005.08.23 23:34:06 | 000,029,184 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\no23xwrapper.dll < End of report > |
|
14.09.2012, 08:34
| #4 |
| | System Message - Write Fault Error / system error hard disk failure detected Hi,
 Code:
ATTFilter :OTL
PRC - C:\ProgramData\QqKfUnJuwERq.exe (CQP)
O4 - HKCU..\Run: [jipudqbw] "C:\Users\Diseck\AppData\Local\hpidhalm.exe" File not found
O4 - HKCU..\Run: [nbxlbdib] "C:\Users\Diseck\AppData\Local\hpidhalm.exe" File not found
O4 - HKCU..\Run: [QqKfUnJuwERq.exe] C:\ProgramData\QqKfUnJuwERq.exe (CQP)
O4 - HKCU..\Run: [xawnaakp] "C:\Users\Diseck\AppData\Local\awphddcn.exe" File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
[2012.09.11 23:13:01 | 000,278,016 | -H-- | C] (CQP) -- C:\ProgramData\lN4g81Fi3fHQ6c.exe
[2012.09.11 22:59:57 | 000,380,416 | -H-- | C] (CQP) -- C:\ProgramData\QqKfUnJuwERq.exe
[2012.09.12 00:13:39 | 000,380,416 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\jfemgpvq.exe
[2012.09.11 23:13:19 | 000,000,112 | -H-- | M] () -- C:\ProgramData\lN4g81Fi3fHQ6c
[2012.09.11 23:13:01 | 000,278,016 | -H-- | M] (CQP) -- C:\ProgramData\lN4g81Fi3fHQ6c.exe
[2012.09.11 22:57:20 | 000,380,416 | -H-- | M] (CQP) -- C:\ProgramData\QqKfUnJuwERq.exe
[2012.09.11 22:57:15 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\nvjqxxrf
[2012.09.11 07:49:26 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\srqhqhga
[2012.09.10 22:49:58 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\gajqewcl
[2012.09.10 21:16:23 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\qrmmbeqi
[2012.09.10 08:51:44 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\rjudvgwt
[2012.09.09 16:24:15 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\ixcgowmx
[2012.09.08 13:55:18 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\cfhxhkng
[2012.09.07 20:45:22 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\sfqtvwvg
[2012.09.06 20:52:38 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\ffgvhpfq
[2012.09.06 16:01:35 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\wtqhfwnf
[2012.09.05 23:19:14 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\nnocvtbl
[2012.09.04 21:10:11 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\ldnujfdh
[2012.09.03 21:43:50 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\ccjoetux
[2012.09.03 20:31:35 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\wdajqqsp
[2012.09.02 16:03:56 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\mhokdnuw
[2012.09.01 14:22:29 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\usipaceh
[2012.08.31 15:04:35 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\sppkauuw
[2012.08.31 00:11:25 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\kxlrinlq
[2012.08.30 16:57:06 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\gwtdjdnv
[2012.08.30 16:52:36 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\gxaifewv
[2012.08.29 21:08:58 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\pnusprao
[2012.08.29 18:57:54 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\wxrvdbnd
[2012.08.29 16:07:04 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\hcvgdtup
[2012.08.29 15:46:42 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\jknoxhjh
[2012.08.29 05:24:14 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\qmlaqoaw
[2012.08.28 13:07:14 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\ecehjngf
[2012.08.27 22:52:37 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\wwvhjnup
[2012.08.26 18:06:21 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\ledgaeqn
[2012.08.26 01:16:07 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\ngahoagv
[2012.08.24 16:45:36 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\pbomxtej
[2012.08.24 07:50:04 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\bkjexcbc
[2012.08.23 14:38:08 | 000,059,392 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\lnqaxxsb
[2012.08.21 09:40:47 | 000,059,904 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\bucopatf
[2012.08.16 14:00:46 | 000,059,904 | -H-- | M] () -- C:\Users\Diseck\AppData\Local\nxonvsqq
:Commands
[purity]
[emptytemp]
[Reboot]
Cureit Folge der Anleitung: http://www.trojaner-board.de/59299-a...eb-cureit.html Nach Beendigung des Scans findes Du das Log unter %USERPROFILE%\DoctorWeb\CureIt.log. Bevor du irgendwelche Aktionen unternimmst, kopiere bitte den Inhalt des Logs und poste ihn. Die Log Datei ist sehr groß, ca. über 5MB Text. Benutzt einfach die Suche nach "infiziert" und kopiert betreffende Teile heraus, bevor Du sie postet. AdwareCleaner (AdwCleaner) Wichtig: Alle Befehle bitte als Administrator ausführen! rechte Maustaste auf die Eingabeaufforderung und "als Administrator ausführen" auswählen Auf der angewählten Anwendung einen Rechtsklick (rechte Maustaste) und "Als Administrator ausführen" wählen! Poste die Logfiles in Code-Tags Download über AdwCleaner by Xplode zum Desktop.  Starte AdwCleaner und klicke Search Nach einiger zeit öffnet ein Logfile (C:\AdwCleaner[xx].txt) poste dessen Inhalt hier ins Forum. chris
__________________  Don't bring me downVor dem posten beachten! Spenden (Wer spenden will, kann sich gerne melden  ) |
|
18.09.2012, 16:08
| #5 |
| | System Message - Write Fault Error / system error hard disk failure detected Hallo Chris, erstmal vielen Dank für die bisherige Hilfe! # AdwCleaner v2.002 - Datei am 09/18/2012 um 15:40:08 erstellt # Aktualisiert am 16/09/2012 von Xplode # Betriebssystem : Windows 7 Ultimate (64 bits) # Benutzer : Diseck - DISECK-PC # Bootmodus : Normal # Ausgeführt unter : H:\adwcleaner.exe # Option [Suche] **** [Dienste] **** ***** [Dateien / Ordner] ***** Ordner Gefunden : C:\Program Files (x86)\Ask.com Ordner Gefunden : C:\Program Files (x86)\Conduit Ordner Gefunden : C:\Program Files (x86)\ConduitEngine Ordner Gefunden : C:\Program Files (x86)\SFT_de3 Ordner Gefunden : C:\Users\Diseck\AppData\Local\AskToolbar Ordner Gefunden : C:\Users\Diseck\AppData\Local\Conduit Ordner Gefunden : C:\Users\Diseck\AppData\LocalLow\AskToolbar Ordner Gefunden : C:\Users\Diseck\AppData\LocalLow\boost_interprocess Ordner Gefunden : C:\Users\Diseck\AppData\LocalLow\Conduit Ordner Gefunden : C:\Users\Diseck\AppData\LocalLow\ConduitEngine Ordner Gefunden : C:\Users\Diseck\AppData\LocalLow\SFT_de3 Ordner Gefunden : C:\Users\Diseck\AppData\Roaming\eType Ordner Gefunden : C:\Users\Diseck\AppData\Roaming\loadtbs Ordner Gefunden : C:\Users\Diseck\AppData\Roaming\Mozilla\Firefox\Profiles\sg49yi49.default\extensions\{ff88a983-649d-4207-9336-9b999280b436} Ordner Gefunden : C:\Users\Diseck\AppData\Roaming\Mozilla\Firefox\Profiles\sg49yi49.default\extensions\toolbar@ask.com Ordner Gefunden : C:\Users\Diseck\AppData\Roaming\Mozilla\Firefox\Profiles\sg49yi49.default\extensions\welcome@toolmin.com Ordner Gefunden : C:\Users\Diseck\AppData\Roaming\toolplugin Ordner Gefunden : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE} ***** [Registrierungsdatenbank] ***** Schlüssel Gefunden : HKCU\Software\AppDataLow\AskToolbarInfo Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\AskToolbar Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\Conduit Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\conduitEngine Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\conduitEngine Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\SFT_de3 Schlüssel Gefunden : HKCU\Software\AppDataLow\Toolbar Schlüssel Gefunden : HKCU\Software\Ask.com Schlüssel Gefunden : HKCU\Software\AskToolbar Schlüssel Gefunden : HKCU\Software\DSNR Labs Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A} Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{30F9B915-B755-4826-820B-08FBA6BD249D} Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{30F9B915-B755-4826-820B-08FBA6BD249D} Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440} Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{DFEFCDEE-CF1A-4FC8-88AD-129872198372} Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FF88A983-649D-4207-9336-9B999280B436} Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D} Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D} Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440} Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DFEFCDEE-CF1A-4FC8-88AD-129872198372} Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DFEFCDEE-CF1A-4FC8-89AF-189327213627} Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FF88A983-649D-4207-9336-9B999280B436} Schlüssel Gefunden : HKCU\Software\Softonic Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Conduit.Engine Schlüssel Gefunden : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd Schlüssel Gefunden : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar.CT3031778 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56} Schlüssel Gefunden : HKLM\Software\Conduit Schlüssel Gefunden : HKLM\Software\conduitEngine Schlüssel Gefunden : HKLM\Software\conduitEngine Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{BE5E5AC1-9926-4F3D-B850-8923E652A79E} Schlüssel Gefunden : HKLM\Software\SFT_de3 Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{BE5E5AC1-9926-4F3D-B850-8923E652A79E} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DFEFCDEE-CF1A-4FC8-88AD-129872198372} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DFEFCDEE-CF1A-4FC8-89AF-189327213627} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FF88A983-649D-4207-9336-9B999280B436} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1CFF9C32-F8B5-4A59-AAB3-317E68BFE8FD} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4E18B133-FAF8-4EA7-A335-87F22855D2B6} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CC865572-6094-41B5-908E-C7753849E883} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FF88A983-649D-4207-9336-9B999280B436} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Conduit Engine Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SFT_de3 Toolbar Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF Schlüssel Gefunden : HKU\S-1-5-21-3552938585-4215424134-861268927-1000\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}] Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{FF88A983-649D-4207-9336-9B999280B436}] Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{FF88A983-649D-4207-9336-9B999280B436}] Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{FF88A983-649D-4207-9336-9B999280B436}] Wert Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{30F9B915-B755-4826-820B-08FBA6BD249D}] Wert Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{30F9B915-B755-4826-820B-08FBA6BD249D}] Wert Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}] Wert Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{DFEFCDEE-CF1A-4FC8-88AD-129872198372}] Wert Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{DFEFCDEE-CF1A-4FC8-89AF-189327213627}] Wert Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{FF88A983-649D-4207-9336-9B999280B436}] ***** [Internet Browser] ***** -\\ Internet Explorer v9.0.8112.16421 [OK] Die Registrierungsdatenbank ist sauber. -\\ Mozilla Firefox v15.0 (en-US) Profilname : default Datei : C:\Users\Diseck\AppData\Roaming\Mozilla\Firefox\Profiles\sg49yi49.default\prefs.js Gefunden : user_pref("browser.search.defaultenginename", "Search the web"); Gefunden : user_pref("browser.search.order.1", "Search the web"); ************************* AdwCleaner[R1].txt - [10091 octets] - [18/09/2012 15:40:08] ########## EOF - C:\AdwCleaner[R1].txt - [10152 octets] ########## Ergebnis DrWeb: H:\_OTL\MovedFiles\09152012_015637.log - OK H:\_OTL\MovedFiles\09152012_015637\C_ProgramData\QqKfUnJuwERq.exe infiziert mit Trojan.Fakealert.33688 - gelöscht H:\_OTL\MovedFiles\09152012_015637\C_ProgramData\lN4g81Fi3fHQ6c.exe - OK H:\_OTL\MovedFiles\09152012_015637\C_ProgramData\lN4g81Fi3fHQ6c - OK H:\_OTL\MovedFiles\09152012_015637\C_Users\Diseck\AppData\Local\jfemgpvq.exe infiziert mit Trojan.Fakealert.33688 - gelöscht H:\_OTL\MovedFiles\09152012_015637\C_Users\Diseck\AppData\Local\nvjqxxrf gepackt von XOREXE >H:\_OTL\MovedFiles\09152012_015637\C_Users\Diseck\AppData\Local\nvjqxxrf - OK |
|
19.09.2012, 06:52
| #6 |
| | System Message - Write Fault Error / system error hard disk failure detected Hi, AdwareCleaner Schliesse alle offenstehende Fenster und starte AdwCleaner (Win7/Vista: Als Administrator ausführen)
Dein Rechner wird neu gestartet und es öffnet sich ein Logfile (C:\AdwCleaner[xx].txt), poste dessen Inhalt hier ins Forum. Erstelle und poste mal ein neues OTL-Log! chris
__________________ --> System Message - Write Fault Error / system error hard disk failure detected |
|
19.09.2012, 11:45
| #7 |
| | System Message - Write Fault Error / system error hard disk failure detected Hallo, # AdwCleaner v2.002 - Datei am 09/19/2012 um 13:21:41 erstellt # Aktualisiert am 16/09/2012 von Xplode # Betriebssystem : Windows 7 Ultimate (64 bits) # Benutzer : Diseck - DISECK-PC # Bootmodus : Normal # Ausgeführt unter : C:\Users\Diseck\Desktop\adwcleaner.exe # Option [Löschen] **** [Dienste] **** ***** [Dateien / Ordner] ***** ***** [Registrierungsdatenbank] ***** ***** [Internet Browser] ***** -\\ Internet Explorer v9.0.8112.16421 -\\ Mozilla Firefox v15.0 (en-US) Profilname : default Datei : C:\Users\Diseck\AppData\Roaming\Mozilla\Firefox\Profiles\sg49yi49.default\prefs.js [OK] Die Datei ist sauber. ************************* AdwCleaner[R1].txt - [10212 octets] - [18/09/2012 15:40:08] AdwCleaner[R2].txt - [10273 octets] - [19/09/2012 01:14:27] AdwCleaner[S1].txt - [9912 octets] - [19/09/2012 13:19:17] AdwCleaner[S2].txt - [871 octets] - [19/09/2012 13:21:41] ########## EOF - C:\AdwCleaner[S2].txt - [930 octets] ########## OTL Logfile: Code:
ATTFilter OTL logfile created on: 19.09.2012 13:26:08 - Run 1 OTL by OldTimer - Version 3.2.61.3 Folder = H:\ 64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 2,54 Gb Available Physical Memory | 63,54% Memory free 7,99 Gb Paging File | 6,47 Gb Available in Paging File | 80,91% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 97,66 Gb Total Space | 9,36 Gb Free Space | 9,58% Space Free | Partition Type: NTFS Drive D: | 488,18 Gb Total Space | 199,85 Gb Free Space | 40,94% Space Free | Partition Type: NTFS Drive E: | 345,57 Gb Total Space | 183,08 Gb Free Space | 52,98% Space Free | Partition Type: NTFS Drive F: | 5,75 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF Drive H: | 7,44 Gb Total Space | 7,26 Gb Free Space | 97,63% Space Free | Partition Type: FAT32 Computer Name: DISECK-PC | User Name: Diseck | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - File not found -- PRC - [2012.09.12 22:11:10 | 000,600,064 | ---- | M] (OldTimer Tools) -- H:\OTL.exe PRC - [2012.09.07 17:04:46 | 000,676,936 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2012.09.07 17:04:46 | 000,399,432 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe PRC - [2012.09.07 17:04:44 | 000,766,536 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2012.08.13 13:33:30 | 003,064,000 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe PRC - [2012.06.16 04:24:19 | 000,138,272 | R--- | M] (Symantec Corporation) -- C:\Program Files (x86)\Norton Internet Security\Engine\19.8.0.14\ccSvcHst.exe PRC - [2012.03.19 23:45:16 | 000,076,888 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe PRC - [2012.03.01 02:02:00 | 002,348,352 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe PRC - [2012.02.29 14:26:46 | 000,382,272 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe PRC - [2012.02.23 13:30:40 | 000,059,240 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe PRC - [2011.07.29 01:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe PRC - [2011.06.06 13:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2010.07.15 19:58:24 | 009,936,512 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Programme\ASUS\TurboV EVO\TurboV_EVO.exe PRC - [2010.07.07 11:58:02 | 001,089,664 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Programme\ASUS\TurboV EVO\TurboVHelp.exe PRC - [2010.06.24 08:19:50 | 000,109,056 | R--- | M] () -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.05\AsSysCtrlService.exe PRC - [2010.04.27 04:09:52 | 000,113,288 | ---- | M] (Renesas Electronics Corporation) -- C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe PRC - [2010.03.27 13:41:20 | 001,137,280 | ---- | M] ( ASUSTeK Computer Inc.) -- C:\Programme\ASUS\GPU Boost Driver\GpuBoostServer.exe PRC - [2010.03.25 15:39:22 | 000,490,280 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Nero\Update\NASvc.exe PRC - [2010.03.25 12:02:12 | 000,888,960 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite\QFan4\FanHelp.exe PRC - [2010.03.16 19:22:40 | 005,309,056 | ---- | M] ( ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\EPU\EPU.exe PRC - [2009.10.26 14:16:00 | 000,223,464 | ---- | M] (DeviceVM, Inc.) -- C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe PRC - [2009.10.26 14:15:56 | 000,375,000 | ---- | M] (DeviceVM, Inc.) -- C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe PRC - [2009.04.07 10:13:10 | 000,673,616 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe PRC - [2009.03.30 08:32:40 | 000,032,768 | R--- | M] () -- C:\Windows\DAODx.exe PRC - [2007.07.11 16:09:48 | 000,020,480 | ---- | M] () -- C:\Windows\FixCamera.exe PRC - [2007.05.10 13:18:26 | 000,835,584 | ---- | M] () -- C:\Windows\vsnpstd3.exe PRC - [2007.04.21 09:37:02 | 000,270,336 | ---- | M] () -- C:\Windows\tsnpstd3.exe ========== Modules (No Company Name) ========== MOD - [2012.02.20 22:29:04 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2012.02.20 22:28:42 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll MOD - [2011.07.29 01:09:42 | 000,096,112 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll MOD - [2011.07.29 01:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe MOD - [2010.06.01 11:38:40 | 000,253,952 | ---- | M] () -- C:\Programme\ASUS\TurboV EVO\pngio.dll MOD - [2010.06.01 11:38:40 | 000,061,440 | ---- | M] () -- C:\Programme\ASUS\TurboV EVO\flashobj.dll MOD - [2010.02.08 18:19:52 | 000,053,248 | ---- | M] () -- C:\Programme\ASUS\TurboV EVO\HookKey32.dll MOD - [2010.01.08 18:17:24 | 000,565,248 | ---- | M] () -- C:\Program Files (x86)\ASUS\EPU\pngio.dll MOD - [2010.01.08 18:17:24 | 000,053,248 | ---- | M] () -- C:\Program Files (x86)\ASUS\EPU\AsSpindownTimeout.dll MOD - [2009.09.30 05:33:07 | 000,024,576 | R--- | M] () -- C:\Windows\SysWOW64\AsIO.dll MOD - [2009.06.27 11:11:12 | 000,503,202 | ---- | M] () -- C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\sqlite3.dll MOD - [2009.06.17 12:40:16 | 007,745,536 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll MOD - [2009.06.17 12:40:16 | 002,121,728 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll MOD - [2009.06.17 12:40:16 | 000,135,168 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll MOD - [2009.04.22 21:20:00 | 000,179,712 | ---- | M] () -- C:\Program Files (x86)\ASUS\EPU\ASUSSERVICE.DLL MOD - [2009.03.30 08:32:40 | 000,032,768 | R--- | M] () -- C:\Windows\DAODx.exe MOD - [2009.03.12 16:45:32 | 000,135,168 | ---- | M] () -- C:\PROGRA~2\EPSONS~1\EVENTM~1\ASSIST~1\SCANAS~1\SCANEN~1.DLL MOD - [2008.11.21 14:58:42 | 000,057,344 | ---- | M] () -- C:\PROGRA~2\EPSONS~1\EVENTM~1\ASSIST~1\SCANAS~1\SATWAIN.dll MOD - [2007.07.11 16:09:48 | 000,020,480 | ---- | M] () -- C:\Windows\FixCamera.exe MOD - [2007.05.10 13:18:26 | 000,835,584 | ---- | M] () -- C:\Windows\vsnpstd3.exe MOD - [2007.04.21 09:37:02 | 000,270,336 | ---- | M] () -- C:\Windows\tsnpstd3.exe ========== Services (SafeList) ========== SRV:64bit: - [2010.02.10 16:05:46 | 000,202,752 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV:64bit: - [2009.04.21 13:59:08 | 002,869,760 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Auto | Running] -- C:\Windows\SysNative\hasplms.exe -- (hasplms) SRV - [2012.09.07 22:24:08 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.09.07 17:04:46 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2012.09.07 17:04:46 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler) SRV - [2012.08.24 18:18:56 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.08.13 13:33:30 | 003,064,000 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service) SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.06.16 04:24:19 | 000,138,272 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Norton Internet Security\Engine\19.8.0.14\ccSvcHst.exe -- (NIS) SRV - [2012.03.19 23:45:16 | 000,076,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA) SRV - [2012.03.01 02:02:00 | 002,348,352 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService) SRV - [2012.02.29 14:26:46 | 000,382,272 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service) SRV - [2011.06.06 13:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011.03.28 21:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2010.06.24 08:19:50 | 000,109,056 | R--- | M] () [Auto | Running] -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.05\AsSysCtrlService.exe -- (AsSysCtrlService) SRV - [2010.03.25 15:39:22 | 000,490,280 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate) SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009.10.26 14:16:00 | 000,223,464 | ---- | M] (DeviceVM, Inc.) [Auto | Running] -- C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe -- (BCUService) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.09.07 17:04:46 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector) DRV:64bit: - [2012.07.06 04:17:58 | 000,037,536 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1308000.00E\srtspx64.sys -- (SRTSPX) DRV:64bit: - [2012.07.06 04:17:57 | 000,737,952 | ---- | M] (Symantec Corporation) [File_System | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1308000.00E\srtsp64.sys -- (SRTSP) DRV:64bit: - [2012.06.07 06:43:38 | 000,167,072 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1308000.00E\ccsetx64.sys -- (ccSet_NIS) DRV:64bit: - [2012.05.22 03:37:12 | 001,129,120 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\NISx64\1308000.00E\symefa64.sys -- (SymEFA) DRV:64bit: - [2012.04.18 04:13:32 | 000,405,624 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1308000.00E\symnets.sys -- (SymNetS) DRV:64bit: - [2012.04.18 03:42:14 | 000,190,072 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1308000.00E\ironx64.sys -- (SymIRON) DRV:64bit: - [2012.03.27 20:33:01 | 000,175,736 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS -- (SymEvent) DRV:64bit: - [2012.03.01 08:54:38 | 000,022,896 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2012.02.22 22:41:18 | 000,283,200 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01) DRV:64bit: - [2012.02.15 12:01:50 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64) DRV:64bit: - [2012.01.17 14:45:56 | 000,188,224 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA) DRV:64bit: - [2011.07.25 20:18:36 | 000,451,192 | R--- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\NISx64\1308000.00E\symds64.sys -- (SymDS) DRV:64bit: - [2011.03.11 08:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 08:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.05.31 05:46:50 | 000,333,928 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:64bit: - [2010.04.27 03:30:52 | 000,184,968 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc) DRV:64bit: - [2010.04.27 03:29:54 | 000,083,080 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub) DRV:64bit: - [2010.02.10 16:24:06 | 006,368,256 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atipmdag.sys -- (amdkmdag) DRV:64bit: - [2010.02.10 15:11:14 | 000,188,416 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap) DRV:64bit: - [2010.01.28 03:33:38 | 000,116,736 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService) DRV:64bit: - [2010.01.11 13:28:34 | 000,115,824 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\jraid.sys -- (JRAID) DRV:64bit: - [2009.08.26 08:48:44 | 000,071,040 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\aksdf.sys -- (aksdf) DRV:64bit: - [2009.07.16 05:38:40 | 000,015,416 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.07.13 23:59:33 | 005,020,672 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.05.18 14:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:64bit: - [2009.05.05 03:00:28 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie.sys -- (AtiPcie) DRV:64bit: - [2009.03.18 16:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi) DRV:64bit: - [2009.03.13 12:55:38 | 000,318,464 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\hardlock.sys -- (hardlock) DRV:64bit: - [2009.01.08 12:55:04 | 000,129,280 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\aksfridge.sys -- (aksfridge) DRV:64bit: - [2007.10.16 10:36:46 | 010,693,120 | ---- | M] (Sonix Co. Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\snpstd3.sys -- (SNPSTD3) DRV - [2012.09.11 23:07:19 | 002,084,000 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\VirusDefs\20120911.002\ex64.sys -- (NAVEX15) DRV - [2012.09.11 23:07:19 | 000,125,600 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\VirusDefs\20120911.002\eng64.sys -- (NAVENG) DRV - [2012.09.01 02:27:23 | 000,513,184 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\IPSDefs\20120908.001\IDSviA64.sys -- (IDSVia64) DRV - [2012.09.01 00:09:13 | 001,385,120 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\BASHDefs\20120905.001\BHDrvx64.sys -- (BHDrvx64) DRV - [2012.08.30 02:36:17 | 000,484,512 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys -- (eeCtrl) DRV - [2012.08.13 07:25:04 | 000,138,912 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) DRV - [2007.10.16 10:35:58 | 010,376,576 | ---- | M] (Sonix Co. Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\snpstd3.sys -- (SNPSTD3) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 1E 10 DD AC 0F 82 CD 01 [binary data] IE - HKCU\..\URLSearchHook: {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll (DeviceVM, Inc.) IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{219A0209-EFB1-450d-B86E-CC8F5A369719}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=EGMB IE - HKCU\..\SearchScopes\{5F70BF71-5042-4d6e-98D2-E6908CD6CCA4}: "URL" = hxxp://www.google.com/custom?client=pub-3794288947762788&forid=1&channel=5369970905&ie=UTF-8&oe=UTF-8&safe=active&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A1&hl=de&q={searchTerms} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.startup.homepage: "google.de" FF - prefs.js..extensions.enabledAddons: software@loadtubes.com:1.01 FF - prefs.js..extensions.enabledAddons: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.2.145 FF - prefs.js..keyword.URL: "hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q=" FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_271.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_271.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.116.0: C:\Program Files (x86)\Battlelog Web Plugins\1.116.0\npesnlaunch.dll File not found FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.122.0: C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\IPSFFPlgn\ [2012.03.13 21:24:18 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\coFFPlgn\ [2012.09.19 13:22:57 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.02.16 01:46:49 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.09.07 22:24:08 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.09.07 22:24:06 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.09.07 22:24:08 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.09.07 22:24:06 | 000,000,000 | ---D | M] [2011.12.21 00:15:06 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Diseck\AppData\Roaming\mozilla\Extensions [2012.09.19 13:19:20 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Diseck\AppData\Roaming\mozilla\Firefox\Profiles\sg49yi49.default\extensions [2012.04.10 23:54:57 | 000,000,000 | -H-D | M] (loadtbs) -- C:\Users\Diseck\AppData\Roaming\mozilla\Firefox\Profiles\sg49yi49.default\extensions\software@loadtubes.com [2012.09.07 22:24:06 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012.09.07 22:24:06 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012.02.16 01:46:49 | 000,000,000 | ---D | M] (DivX Plus Web Player HTML5 <video>) -- C:\PROGRAM FILES (X86)\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5 [2012.09.07 22:24:08 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2012.02.15 16:48:02 | 000,378,880 | ---- | M] (InfiniAd GmbH) -- C:\Program Files (x86)\mozilla firefox\plugins\npmieze.dll [2012.09.02 16:05:13 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012.02.15 22:55:08 | 000,000,158 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\Search the web.src [2012.09.02 16:05:13 | 000,002,253 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\19.8.0.14\coIEPlg.dll (Symantec Corporation) O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\19.8.0.14\IPS\IPSBHO.DLL (Symantec Corporation) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation) O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\19.8.0.14\coIEPlg.dll (Symantec Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\19.8.0.14\coIEPlg.dll (Symantec Corporation) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4:64bit: - HKLM..\Run: [snpstd3] C:\Windows\vsnpstd3.exe () O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [BCU] C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe (DeviceVM, Inc.) O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () O4 - HKLM..\Run: [EEventManager] C:\PROGRA~2\EPSONS~1\EVENTM~1\EEventManager.exe (SEIKO EPSON CORPORATION) O4 - HKLM..\Run: [FixCamera] C:\Windows\FixCamera.exe () O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe () O4 - HKLM..\Run: [LogMeIn Hamachi Ui] "E:\Games\hamachi-2-ui.exe" --auto-start File not found O4 - HKLM..\Run: [NBAgent] C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe (Nero AG) O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation) O4 - HKLM..\Run: [QFan Help] C:\Program Files (x86)\ASUS\AI Suite\QFan4\FanHelp.exe (ASUSTeK Computer Inc.) O4 - HKLM..\Run: [Six Engine] C:\Program Files (x86)\ASUS\EPU\EPU.exe ( ASUSTeK Computer Inc.) O4 - HKLM..\Run: [snpstd3] C:\Windows\vsnpstd3.exe () O4 - HKLM..\Run: [tsnpstd3] C:\Windows\tsnpstd3.exe () O4 - HKLM..\Run: [TurboV EVO] C:\Program Files\ASUS\TurboV EVO\TurboV_EVO.exe (ASUSTeK Computer Inc.) O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) O4 - HKCU..\Run: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 0 O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{01645BFC-4730-4BF4-A457-2D40CE30E6ED}: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation) O20 - HKCU Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.07.14 11:29:38 | 000,000,122 | R--- | M] () - F:\autorun.inf -- [ UDF ] O33 - MountPoints2\{111c5bcd-2b1b-11e1-a82d-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{111c5bcd-2b1b-11e1-a82d-806e6f6e6963}\Shell\AutoRun\command - "" = F:\Autorun.exe O33 - MountPoints2\{4e36f707-2b12-11e1-b7c2-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{4e36f707-2b12-11e1-b7c2-806e6f6e6963}\Shell\AutoRun\command - "" = F:\.\Bin\ASSETUP.exe O33 - MountPoints2\{b3a47061-5d5f-11e1-ba86-20cf305acc61}\Shell - "" = AutoRun O33 - MountPoints2\{b3a47061-5d5f-11e1-ba86-20cf305acc61}\Shell\AutoRun\command - "" = G:\Autorun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.09.19 13:23:25 | 000,000,000 | ---D | C] -- C:\Users\Diseck\AppData\Local\{E6B48172-BF62-4570-9E7D-957BEBE438DB} [2012.09.19 13:21:14 | 000,000,000 | ---D | C] -- C:\Users\Diseck\AppData\Local\{1BC25F35-EE7A-4751-BE7A-6354A3A120D4} [2012.09.19 13:18:20 | 000,000,000 | ---D | C] -- C:\Users\Diseck\AppData\Local\{2D317D9C-720E-42E4-8E55-E7FD92F9518E} [2012.09.18 15:12:42 | 000,000,000 | ---D | C] -- C:\Users\Diseck\AppData\Local\{756C70C9-63A3-4E30-912D-3F955CB1FAFA} [2012.09.18 03:57:28 | 000,000,000 | ---D | C] -- C:\Users\Diseck\AppData\Local\{A26F6241-28A8-44C8-BE5E-CA7D1A8E34C2} [2012.09.15 02:30:33 | 000,000,000 | ---D | C] -- C:\Users\Diseck\DoctorWeb [2012.09.15 02:25:08 | 000,000,000 | ---D | C] -- C:\Users\Diseck\AppData\Local\{6D7AB597-67E2-4BB5-80ED-AD1DBA1B7201} [2012.09.15 02:00:03 | 000,000,000 | ---D | C] -- C:\Users\Diseck\AppData\Local\{7407202A-4B7E-4C74-83D7-A640D758EC64} [2012.09.15 01:10:43 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{2350ED60-B2D7-49B1-A7D6-0AF69917C087} [2012.09.13 15:08:50 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{C7CF6F77-E251-4070-A84F-C982A3BA47A4} [2012.09.13 14:20:28 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{91327B91-9B20-42C7-84AD-84D108049D1D} [2012.09.13 14:15:50 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{900D30A8-0B60-40CC-92B9-B7FBA6635DD1} [2012.09.13 13:28:00 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{3A94DC83-7B60-4F66-9FBE-D5F29B2C9DD6} [2012.09.12 23:31:31 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Roaming\Malwarebytes [2012.09.12 23:31:27 | 000,000,000 | -H-D | C] -- C:\ProgramData\Malwarebytes [2012.09.12 23:31:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.09.12 23:31:26 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.09.12 23:31:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2012.09.12 23:23:00 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{0A806097-9621-46EA-ADEF-BC0858546C8B} [2012.09.11 22:57:57 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{CA561361-D402-4A77-AC55-7C6A6EC45804} [2012.09.10 21:16:49 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{7614E840-B385-46AD-B0DF-1B78848CF1F4} [2012.09.10 08:51:47 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{1CFA2A96-3251-4F48-95D2-3E5E6AD9B8F2} [2012.09.09 16:24:34 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{3980F12C-656A-43EE-95D1-E986A74F4FA6} [2012.09.07 22:24:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2012.09.07 20:45:38 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{949EAA69-DBD8-4F56-830B-813638BE75EE} [2012.09.07 07:53:17 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{971F6D43-3BF1-46DB-9B89-6428E772A529} [2012.09.06 16:01:27 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{5C990785-DB68-458A-8BF9-86B2B4D6D258} [2012.09.05 23:19:15 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{4D854A1B-48A5-42B0-9428-217309A57C96} [2012.09.04 21:09:36 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{E256DF5F-0D7C-4ABB-AF6B-F6AC5ABA5D5C} [2012.09.04 08:54:30 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{D13C1875-A210-4D7E-A989-AA6506699BE0} [2012.09.03 20:31:29 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{9F2A058F-9036-4230-B662-960437218C42} [2012.09.03 08:27:29 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{8BD0E2D1-87B2-44C5-8098-EA41C8408C4E} [2012.09.02 16:04:02 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{CAE9492B-2A45-4DD0-ACE9-306ABF740DC4} [2012.09.02 02:22:52 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{8868E99D-5C9E-449A-B148-B80C652058D5} [2012.09.01 14:22:25 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{D6785F46-81D4-437E-94DA-3188DF57FD83} [2012.08.31 15:04:41 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{CB0EFF37-2309-4620-BECA-E5FAD45BB8AC} [2012.08.30 17:15:26 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\appmgmt [2012.08.30 16:53:29 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{CC85F00B-8114-42F2-BBE5-34BF278A3DD2} [2012.08.30 16:53:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi [2012.08.30 03:32:02 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{4908FCCC-5A3B-45DE-ABFB-18ECA479C24E} [2012.08.30 03:11:32 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{8A04626F-DF3D-450F-9A6B-57A0556ECF7C} [2012.08.27 21:42:20 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{9BAFE2D7-131F-4C30-A689-5C3A0871AAA0} [2012.08.27 17:19:51 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{46E80FC6-B892-46FC-A4BC-7CDC99E3C30E} [2012.08.27 00:25:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VID_0E8F&PID_0003 [2012.08.27 00:11:58 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{EE8731D8-0435-4914-B4C3-0E1F9077F7DD} [2012.08.26 15:21:04 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\Documents\Eden Games [2012.08.26 15:18:58 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\CrashRpt [2012.08.26 01:16:31 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{7AF1357A-844C-46EB-80E4-C6047089D43A} [2012.08.24 23:54:42 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{ED67B027-5092-4640-AC0B-14328A19ACF0} [2012.08.24 19:25:56 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\Macromedia [2012.08.24 18:03:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Atari [2012.08.24 17:50:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service [2012.08.24 17:48:34 | 000,426,184 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2012.08.24 07:49:49 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{408A675C-154A-41BC-890B-12766DC666DB} [2012.08.23 12:19:51 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{67AEAA0E-E09A-46F7-941D-9EBBC2A81ED2} [2012.08.21 21:35:27 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{4063671E-2AA3-49B7-A238-0151D2D98A6D} [2012.08.21 02:50:07 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{0C20C1A8-4519-4342-BC12-9D6B66E26DD7} [2012.08.20 14:25:44 | 000,000,000 | -H-D | C] -- C:\Users\Diseck\AppData\Local\{A31AD4E3-6882-42F9-BAA4-9325A23DD773} [2007.08.13 18:46:00 | 000,102,912 | -H-- | C] (Albert L Faber) -- C:\Users\Diseck\AppData\Local\CDRip.dll [2007.01.18 22:09:54 | 000,623,616 | -H-- | C] (Ivan Bischof ©2003 - 2005) -- C:\Users\Diseck\AppData\Local\No23 Recorder.exe [2006.12.11 20:13:14 | 000,013,872 | -H-- | C] (Un4seen Developments) -- C:\Users\Diseck\AppData\Local\basscd.dll [2006.12.11 20:13:12 | 000,097,336 | -H-- | C] (Un4seen Developments) -- C:\Users\Diseck\AppData\Local\bass.dll ========== Files - Modified Within 30 Days ========== [2012.09.19 13:30:51 | 000,018,816 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.09.19 13:30:51 | 000,018,816 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.09.19 13:22:40 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.09.19 13:22:35 | 3219,791,872 | -HS- | M] () -- C:\hiberfil.sys [2012.09.19 13:18:05 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.09.18 15:23:02 | 000,000,254 | ---- | M] () -- C:\Windows\tasks\Epson Printer Software Downloader.job [2012.09.18 14:37:20 | 000,512,737 | ---- | M] () -- C:\Users\Diseck\Desktop\adwcleaner.exe [2012.09.15 01:12:28 | 093,133,480 | ---- | M] () -- C:\Users\Diseck\Desktop\drweb-cureit.exe [2012.09.12 23:31:33 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.09.12 23:31:33 | 000,654,150 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.09.12 23:31:33 | 000,616,032 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.09.12 23:31:33 | 000,130,022 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.09.12 23:31:33 | 000,106,412 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.09.07 17:04:46 | 000,025,928 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.08.30 03:37:11 | 000,283,304 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr [2012.08.30 03:37:11 | 000,283,304 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe [2012.08.24 18:18:55 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2012.08.24 18:18:55 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2012.08.24 17:50:19 | 000,001,130 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk ========== Files Created - No Company Name ========== [2012.09.18 15:39:30 | 000,512,737 | ---- | C] () -- C:\Users\Diseck\Desktop\adwcleaner.exe [2012.09.15 02:25:25 | 093,133,480 | ---- | C] () -- C:\Users\Diseck\Desktop\drweb-cureit.exe [2012.08.24 17:50:18 | 000,001,130 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2012.08.24 17:50:10 | 000,001,142 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2012.08.24 17:48:40 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.08.15 12:15:39 | 000,059,904 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\mdhnomdv [2012.08.14 08:37:59 | 000,059,904 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\pvrjupvt [2012.08.13 19:50:35 | 000,060,416 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\vikaxulk [2012.08.12 15:57:16 | 000,060,416 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\wbcafdnh [2012.08.11 12:11:17 | 000,059,904 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\iencaxbe [2012.08.10 21:24:31 | 000,060,416 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\dakuxlcc [2012.08.09 23:41:47 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\tsnntubj [2012.08.08 18:15:10 | 000,058,880 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\hljipudq [2012.08.08 18:14:33 | 000,000,000 | -H-- | C] () -- C:\Users\Diseck\AppData\Roaming\SharedSettings.ccs [2012.06.19 01:14:52 | 000,020,480 | ---- | C] () -- C:\Windows\FixCamera.exe [2012.06.19 01:14:39 | 000,835,584 | ---- | C] () -- C:\Windows\vsnpstd3.exe [2012.06.19 01:14:39 | 000,270,336 | ---- | C] () -- C:\Windows\tsnpstd3.exe [2012.06.19 01:14:39 | 000,015,498 | ---- | C] () -- C:\Windows\snpstd3.ini [2012.06.19 01:14:38 | 000,155,648 | ---- | C] ( ) -- C:\Windows\SysWow64\rsnpstd3.dll [2012.06.19 01:14:38 | 000,057,344 | ---- | C] ( ) -- C:\Windows\SysWow64\vsnpstd3.dll [2012.06.19 01:14:38 | 000,053,248 | ---- | C] ( ) -- C:\Windows\csnpstd3.dll [2012.03.16 02:20:41 | 000,007,651 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\Resmon.ResmonCfg [2012.02.29 14:26:56 | 000,416,064 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe [2011.12.29 21:43:56 | 000,001,459 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\RecConfig.xml [2011.12.21 16:16:39 | 000,111,932 | ---- | C] () -- C:\Windows\SysWow64\EPPICPrinterDB.dat [2011.12.21 16:16:39 | 000,031,053 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern131.dat [2011.12.21 16:16:39 | 000,027,417 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern121.dat [2011.12.21 16:16:39 | 000,026,154 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern1.dat [2011.12.21 16:16:39 | 000,024,903 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern3.dat [2011.12.21 16:16:39 | 000,021,390 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern5.dat [2011.12.21 16:16:39 | 000,020,148 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern2.dat [2011.12.21 16:16:39 | 000,011,811 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern4.dat [2011.12.21 16:16:39 | 000,004,943 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern6.dat [2011.12.21 16:16:39 | 000,001,146 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_DU.dat [2011.12.21 16:16:39 | 000,001,139 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_PT.dat [2011.12.21 16:16:39 | 000,001,139 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_BP.dat [2011.12.21 16:16:39 | 000,001,136 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_ES.dat [2011.12.21 16:16:39 | 000,001,129 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_FR.dat [2011.12.21 16:16:39 | 000,001,129 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_CF.dat [2011.12.21 16:16:39 | 000,001,120 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_IT.dat [2011.12.21 16:16:39 | 000,001,107 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_GE.dat [2011.12.21 16:16:39 | 000,001,104 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_EN.dat [2011.12.21 16:16:39 | 000,000,097 | ---- | C] () -- C:\Windows\SysWow64\PICSDK.ini [2011.12.21 00:41:30 | 000,283,304 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2011.12.21 00:41:29 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe [2011.12.21 00:41:28 | 002,434,856 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_bc2.exe [2011.12.20 16:58:41 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2011.12.20 16:43:18 | 000,024,576 | R--- | C] () -- C:\Windows\SysWow64\AsIO.dll [2011.12.20 16:43:18 | 000,013,440 | R--- | C] () -- C:\Windows\SysWow64\drivers\AsIO.sys [2011.12.20 16:43:15 | 000,011,832 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp64.sys [2011.12.20 16:43:15 | 000,010,216 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp32.sys [2011.12.20 16:40:55 | 000,001,035 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat [2011.12.20 16:34:36 | 000,048,278 | ---- | C] () -- C:\Windows\Ascd_log.ini [2011.12.20 16:33:25 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini [2011.12.20 16:33:19 | 000,032,976 | ---- | C] () -- C:\Windows\Ascd_tmp.ini [2007.08.13 18:46:00 | 000,155,136 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\lame_enc.dll [2006.10.26 02:06:48 | 000,064,000 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\vorbisenc.dll [2006.10.26 02:06:48 | 000,019,456 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\vorbisfile.dll [2006.10.26 02:06:46 | 000,143,872 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\vorbis.dll [2006.10.26 02:06:36 | 000,015,872 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\ogg.dll [2005.08.23 23:34:06 | 000,029,184 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\no23xwrapper.dll < End of report > Grüße David |
|
19.09.2012, 15:49
| #8 |
| | System Message - Write Fault Error / system error hard disk failure detected Hi, wie verhält sich der Rechner? Fix für OTL:
Code:
ATTFilter
:OTL
[2012.08.15 12:15:39 | 000,059,904 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\mdhnomdv
[2012.08.14 08:37:59 | 000,059,904 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\pvrjupvt
[2012.08.13 19:50:35 | 000,060,416 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\vikaxulk
[2012.08.12 15:57:16 | 000,060,416 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\wbcafdnh
[2012.08.11 12:11:17 | 000,059,904 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\iencaxbe
[2012.08.10 21:24:31 | 000,060,416 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\dakuxlcc
[2012.08.09 23:41:47 | 000,059,392 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\tsnntubj
[2012.08.08 18:15:10 | 000,058,880 | -H-- | C] () -- C:\Users\Diseck\AppData\Local\hljipudq
:Commands
[emptytemp]
[Reboot]
chris
__________________ Don't bring me downVor dem posten beachten! Spenden (Wer spenden will, kann sich gerne melden ) |
|
19.09.2012, 18:54
| #9 |
| | System Message - Write Fault Error / system error hard disk failure detected All processes killed ========== OTL ========== C:\Users\Diseck\AppData\Local\mdhnomdv moved successfully. C:\Users\Diseck\AppData\Local\pvrjupvt moved successfully. C:\Users\Diseck\AppData\Local\vikaxulk moved successfully. C:\Users\Diseck\AppData\Local\wbcafdnh moved successfully. C:\Users\Diseck\AppData\Local\iencaxbe moved successfully. C:\Users\Diseck\AppData\Local\dakuxlcc moved successfully. C:\Users\Diseck\AppData\Local\tsnntubj moved successfully. C:\Users\Diseck\AppData\Local\hljipudq moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Diseck ->Temp folder emptied: 97548807 bytes ->Temporary Internet Files folder emptied: 145074 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 0 bytes ->Flash cache emptied: 712 bytes User: Public User: UpdatusUser ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 8405015 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes RecycleBin emptied: 11015074912 bytes Total Files Cleaned = 10.606,00 mb Hallo, die ganzen Fehlermeldungen kommen nicht mehr aber auf die Programme kann ich immer noch nicht zugreifen. Das Startfenster ist komplett leer. kein Arbeitsplatz(Computer), keine Systemsteuerung, keine etc.. Hab auch keine Möglichkeit auf eine ander Fenstpalttenpartition zu zugreifen. Im Startfenster kann ich nur auf "alle Programme" gehen, wenn ich dies mache und eins anklicken steht da leer! |
|
20.09.2012, 06:31
| #10 |
| | System Message - Write Fault Error / system error hard disk failure detected Hi, Unhide Lade Dir unhide von folgender Adresse runter und dann per Doppelklick als Admin ausführen: http://filepony.de/download-unhide/ Es werden alle versteckten Dateien sichtbar gemacht, ggf. welche die versteckt sein sollten wieder unsichtbar machen (Auswählen im Explorer->Eigenschaften->versteckt) Internet Sicherheitszonen zurücksetzen: Folge diesem Link und arbeite alles ab! chris
__________________ Don't bring me downVor dem posten beachten! Spenden (Wer spenden will, kann sich gerne melden ) Geändert von Chris4You (20.09.2012 um 06:43 Uhr) |
|
| Themen zu System Message - Write Fault Error / system error hard disk failure detected |
| autorun, bho, bonjour, browser, busse, desktop, dringend, error, firefox, flash player, frage, helper, install.exe, langs, launch, logfile, mozilla, nvidia update, origin, plug-in, problem, pup.bundleinstaller.bi, realtek, registry, rundll, scan, search the web, security, software, symantec, system, system error, usb 3.0, usenext, vista |
